First MOAD-0003 (Leaked Context) flagship this session. Surfaced via
scanner enhancement: commit 1f48798 (Java ThreadLocal-scoped .set fix)
dropped wildfly M3 noise from 4840 -> 37, exposing this real defect.
Defect: ElytronSecurityIntegration.java:38 declares
private final ThreadLocal<SecurityContext> securityContext = new ThreadLocal<>();
with setSecurityContext() calling .set(context) and ZERO corresponding
.remove() / .set(null) anywhere in the WildFly codebase (verified by
grep -rn). JCA WorkManager reuses pool threads across Work items from
different security principals; a leftover SecurityContext from prior
Work is visible to any subsequent Work that reads getSecurityContext()
before installing its own — which WildflyWorkWrapper.runWork() does
exactly to decide whether to use Elytron-runWork or super.runWork().
Fix: 2-file surgical patch (no SPI change):
1. setSecurityContext(null) now calls .remove() (clear ThreadLocal,
prevent classloader retention)
2. WildflyWorkWrapper.runWork() wraps body in try/finally that calls
setSecurityContext(null) after the Work item completes
This is the inverse pipeline from CWE-407 flagships: scanner improved
its signal-to-noise so triage could find what raw scanning could not
have ranked.
russell@unturf.com
8b04e01458