Description
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.
Published: 2026-10-12
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated access to Quarkus REST Data Panache endpoints, potentially exposing or altering data
Action: Immediate Patch
AI Analysis

Impact

A flaw in Quarkus REST Data Panache allows attackers to bypass security controls on generated endpoints. When developers customize an operation with @MethodProperties without re‑declaring security roles, the code generator silently drops class‑level security annotations, causing the endpoint to default to permissive, unauthenticated access. This enables unauthorized disclosure or modification of data, and the vulnerability is identified as CWE‑425.

Affected Systems

The issue impacts the Red Hat build of Quarkus and Red Hat Exploit Intelligence, specifically the Quarkus 3 product, as indicated by its CPE entry. Any application using Quarkus REST Data Panache in these environments is vulnerable. No further version qualifiers are provided.

Risk and Exploitability

The flaw carries a CVSS score of 9.1 and is not listed in CISA’s KEV catalog. EPSS is not available, so exploitation probability is unknown, but the lack of authentication and the ease with which the vulnerability can be triggered through common customization practices make it attractive to attackers. The likely attack vector is remote, via any network that can reach the exposed REST endpoint.

Generated by OpenCVE AI on October 12, 2026 at 20:46 UTC.

Remediation

Vendor Workaround

To mitigate this issue, restrict network access to Quarkus applications utilizing REST Data Panache to trusted networks or localhost. This can be achieved by configuring firewall rules or network access controls to limit exposure of the affected endpoints. A restart of the application may be required for network configuration changes to take effect.

OpenCVE Recommended Actions

  • Configure firewall rules so Quarkus applications are reachable only from trusted networks or localhost and restart the application to enforce the changes
  • Restart the application after any network‑configuration changes have been applied
  • Ensure that any @MethodProperties customizations explicitly redeclare the required security roles, restoring the original authorization settings
  • Check for and apply vendor‑issued updates or patches from Red Hat or the Quarkus project as soon as they become available

Generated by OpenCVE AI on October 12, 2026 at 20:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:quarkus:3.33::el8
References

Thu, 15 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:quarkus:3 cpe:/a:redhat:quarkus:3.27::el8
References

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat build Of Quarkus
Vendors & Products Redhat build Of Quarkus

Tue, 13 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 12 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.
Title Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations
First Time appeared Redhat
Redhat exploit Intelligence
Redhat quarkus
Weaknesses CWE-425
CPEs cpe:/a:redhat:exploit_intelligence:0
cpe:/a:redhat:quarkus:3
Vendors & Products Redhat
Redhat exploit Intelligence
Redhat quarkus
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Redhat Build Of Quarkus Exploit Intelligence Quarkus
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-15T23:11:43.650Z

Reserved: 2026-09-09T05:58:00.263Z

Link: CVE-2026-87744

cve-icon Vulnrichment

Updated: 2026-10-15T13:24:02.013Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-12T19:16:40.277

Modified: 2026-10-16T00:17:06.277

Link: CVE-2026-87744

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-12T17:50:22Z

Links: CVE-2026-87744 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:15:15Z

Weaknesses
  • CWE-425

    Direct Request ('Forced Browsing')