The flaw arises when the quarkus-vertx-http component concatenates the management root path with permission rules incorrectly, causing security policies to apply to unintended internal paths. This broken access control allows an attacker to bypass intended authorization checks and reach sensitive management endpoints, potentially leading to further system compromise.

Affected products include various Red Hat distributions that incorporate quarkus-vertx-http, such as Exploit Intelligence, OpenShift Serverless, Red Hat Build of Keycloak, Red Hat Fuse 7, Red Hat OpenShift AI, Red Hat OpenShift Dev Spaces, the Red Hat builds of Apache Camel 4 for Quarkus 3, Apicurio Registry 3, Debezium 3, and Quarkus builds. Explicit version information is not supplied in this advisory.

The vulnerability carries a CVSS score of 7.7, indicating high severity. EPSS data is not available, and the issue is not yet listed in CISA’s KEV catalog. The attack vector is inferred to be via the exposed management interface; a remote attacker with network access to the interface could exploit the path concatenation flaw to gain unauthorized administrative access. The lack of a publicly known exploit does not reduce the risk, as an attacker can construct the necessary requests manually based on the component’s documented path handling.