CVE-2009-5066: twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which all...

Security readout for executives and security teams

This issue can expose JBoss administrative credentials when twiddle.sh is run with a username or password on the command line. A local user on the same system may be able to see those arguments in process listings. The risk is mainly credential disclosure, not remote code execution by itself. Exposure is likely limited to systems running affected JBoss AS or EAP versions where administrators use twiddle.sh with credentials on shared or multi-user hosts. Single-purpose servers with tightly restricted shell access have lower practical exposure. Treat this as a targeted credential hygiene issue for legacy JBoss systems. Prioritize remediation where affected servers are shared, have many local users, or use privileged JBoss credentials. It is not presented as internet-exploitable in the supplied sources. Mitigation focus: Apply the relevant Red Hat/JBoss security update after confirming product and version applicability.; Stop passing JBoss credentials through command-line arguments where vendor-supported alternatives exist.; Restrict local shell access to trusted administrators only..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.