In some cases TCK code accesses the system property "validation.provider" (in org.hibernate.beanvalidation.tck.util.TestUtil.instantiateValidationProviderUnderTest()) if there is a BV API frame on the callstack (this happens if this code is triggered through a custom provider resolver, e.g. in org.hibernate.beanvalidation.tck.tests.bootstrap.ValidationProviderTest.testFirstMatchingValidationProviderResolverIsReturned(). As the TCK doesn't use privileged actions, the BV API JAR need to have the permission for reading that property, too.

It's not quite clear to why I'm seeing this issue only now (tests started to fail with a permission exception), as the TCK code hasn't changed in this regard. The fix seems logical to me, I just would have the problem expected to appear already before.