CVE-2026-87744: falha crítica em Red Hat Exploit Intelligence
Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.4%
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Red Hat · Exploit IntelligenceRed Hat · Red Hat build of Quarkus 3.27.6.redhatRed Hat · Red Hat build of Quarkus 3.33.4.redhatCVEs relacionadas — Red Hat Exploit Intelligence
No mesmo produto, das mais perigosas para as menos.
CVE-2026-89059HIGHResteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)EPSS 1.0%CVE-2026-87742HIGHQuarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message bufferingEPSS 0.8%CVE-2026-94449HIGHQuarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of serviceEPSS 0.6%CVE-2026-81829MEDIUMSmallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolverEPSS 0.6%CVE-2026-93432MEDIUMIo.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkusEPSS 0.5%CVE-2026-87743HIGHQuarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http securityEPSS 0.5%