Red Hat Patches Remote Unauthenticated File Read Flaw in RESTEasy Packages
Red Hat published security advisory RHSA-2026:80505 on 12 October 2026, rating it Important and shipping an updated resteasy package for Red Hat Enterprise Linux 9.4 customers on extended support streams. The advisory addresses a single flaw, CVE-2026-17615, described by the vendor as a RESTeasy SourceProvider remote unauthenticated file read in resteasy-core. RESTEasy is the JBoss project that implements the JAX-RS specification and is used to build RESTful web services and Java applications, which means the vulnerable code sits inside the request-handling path of anything built on it. The affected product list covers Red Hat Enterprise Linux Server AUS 9.4, Update Services for SAP Solutions 9.4 for x86_64 and Power LE, the four-years-of-updates channels for ARM 64 and IBM Z, and the Extended Life Cycle channels for x86_64, ARM 64, Power little endian and IBM Z. The fixed build is resteasy-3.0.26-20.el9_4, delivered as the pki-resteasy-client, pki-resteasy-core, pki-resteasy-jackson2-provider and pki-resteasy-servlet-initializer noarch RPMs, and the issue is tracked internally as Bugzilla 2507635.
Red Hat has not published exploitation details in the errata text itself. The advisory names the affected component, SourceProvider within resteasy-core, and the outcome, a remote unauthenticated file read, but directs readers to the CVE page for the CVSS base score, impact statement and acknowledgements rather than describing an attack chain. What the wording establishes is the two properties that matter for triage: the flaw is reachable remotely, and it does not require the attacker to authenticate first. Because RESTEasy ships on these systems as the pki-resteasy subpackages, the practical exposure on a given host depends on whether a service that embeds those libraries is running and whether its listener is reachable from an untrusted network. No public proof-of-concept code or exploit tooling is referenced anywhere in the advisory.
An unauthenticated file read against an application server is valuable to an attacker well beyond the data in any single file. Java application stacks routinely hold configuration files, keystores, database connection strings and service account credentials on the local filesystem, so a reliable read primitive can become a credential harvesting step and a staging point for deeper access without ever triggering an authentication failure. The population affected here is also a specific one: AUS, E4S and Extended Life Cycle channels exist for organisations that deliberately hold a minor release steady, which typically means SAP landscapes, regulated environments and long-lived production estates where change windows are scarce and patch latency is measured in weeks rather than days. Those same estates are often the ones where a certificate or PKI component quietly underpins authentication for everything else. On current exploitation status, FIRST EPSS places CVE-2026-17615 at a 0.6 percent probability of exploitation in the next 30 days, and there is no indication in the vendor advisory of exploitation in the wild. That is a fixed, disclosed flaw with no observed attacker interest so far, which places it in the scheduled-maintenance category rather than the emergency one, while the unauthenticated nature of the flaw keeps it firmly on the list of things worth closing before someone publishes a working exploit.
Attack Surface
Web Application, Server OS
Tactics
Initial Access, Discovery, Collection, Credential Access
Techniques
- T1190 – Exploit Public-Facing Application
- T1083 – File and Directory Discovery
- T1005 – Data from Local System
- T1552.001 – Unsecured Credentials: Credentials In Files
SuperPRO's Threat Countermeasures Procedures
- Apply RHSA-2026:80505 and move resteasy to 3.0.26-20.el9_4 on RHEL 9.4 AUS, Update Services for SAP Solutions and Extended Life Cycle hosts, covering pki-resteasy-client, pki-resteasy-core, pki-resteasy-jackson2-provider and pki-resteasy-servlet-initializer.
- Inventory exposure with 'rpm -q pki-resteasy-core pki-resteasy-client pki-resteasy-jackson2-provider pki-resteasy-servlet-initializer' across x86_64, ppc64le, aarch64 and s390x estates; any build lower than 3.0.26-20.el9_4 still carries CVE-2026-17615.
- Confirm the host is entitled to the correct extended stream before patching, using 'subscription-manager repos –list-enabled', as RHEL 9.4 systems without AUS, E4S or ELS entitlement will never be offered the 3.0.26-20.el9_4 erratum.
- Restart the Java services that load the RESTEasy libraries after the RPM upgrade, for example 'systemctl restart pki-tomcatd.target', because the vulnerable classes remain resident in the running JVM until the process is recycled.
- Restrict network reach to RESTEasy-backed listeners such as the PKI Tomcat ports (TCP 8080 and TCP 8443) to administrative subnets and jump hosts with firewalld or host ACLs until the updated package is confirmed in place.
- Hunt in Tomcat and httpd access logs for unauthenticated requests to REST endpoints containing path traversal sequences, absolute filesystem paths or file:// references, and alert on 200 responses to such requests that return unexpectedly large bodies.
- If a host shows evidence of unauthorised file reads, rotate the secrets reachable by the service account, including PKI keystore and database passwords stored under /var/lib/pki and /etc/pki-* configuration directories.
