CVE-2026-10579

Summary

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.16.0-22.redhat_00057.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.3.14-11.SP11_redhat_00001.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:1.5.26-2.Final_redhat_00001.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:5.0.31-3.SP2_redhat_00001.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:1.10.0-46.Final_redhat_00044.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:4.1.135-1.Final_redhat_00001.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:4.1.135-1.Final_redhat_00001.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.5.5-30.SP12_redhat_00020.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.5.5-24.SP12_redhat_00016.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.2.40-2.SP3_redhat_00001.1.el7eap < *unaffected
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:7.4.25-2.GA_redhat_00001.1.el7eap < *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References