CVE-2022-0866

A flaw was found in Wildfly, where it returns an incorrect caller principal under certain heavily concurrent situations when Elytron Security is used. This flaw allows an attacker to gain improper access to information they should not have.

Mitigation

In order to avoid the possibility of information access, review application source code for '@RunAs' and 'run-as-principal' usage. Also, make sure the application is using or not Elytron Security. It's possible to investigate by checking if the commands from '$JBOSS_HOME/docs/examples/enable-elytron.cli' or similar were executed.