CVE-2026-42333mediumCWE-200

CVE-2026-42333: medium-severity vulnerability in quarkiverse quarkus-openapi-generator

quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations

Published · Updated

Follow this CVE+ Monitor quarkus-openapi-generator+ Monitor io.quarkiverse.openapi.generator:quarkus-openapi-generator

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.4%
Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security scheme configured for one operation can therefore be applied to a different same-method operation whose path only partially resembles the protected template, causing bearer tokens, API keys, or basic credentials to be sent to unintended endpoints. This issue has been patched in versions 2.11.1-lts, 2.16.0-lts, and 2.17.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
quarkiverse · quarkus-openapi-generator
Related CVEs — quarkiverse quarkus-openapi-generator

In the same product, most dangerous first.

CVE-2026-40180HIGHZip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper classEPSS 0.4%