CVE-2026-68536

Apache MyFaces Core, the Apache implementation of JavaServer Faces (JSF) used by Java web applications, contains a Server-Side Request Forgery flaw (CWE-918) that can also lead to Local File Inclusion. An attacker can trigger it by sending a crafted request to an application running a vulnerable MyFaces Core version, causing the server to issue requests to attacker-chosen URLs and/or read local files. Depending on the hosting environment, this could expose internal services, cloud metadata endpoints, configuration files, or credentials. Any JSF-based application running MyFaces Core before the patched releases is affected, and older unsupported versions may also be vulnerable. No public proof-of-concept is known, the issue is not in CISA KEV, and no exploitation has been reported to date.

What to do: Upgrade MyFaces Core to 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4 depending on the release branch in use, and check build manifests for the org.apache.myfaces.core artifact to identify vulnerable applications. Audit internet-facing .jsf/.xhtml endpoints, and as interim mitigation restrict the application server's outbound network access and file-read permissions. Applications on older unsupported MyFaces versions should be migrated to a supported patched branch.