Description
A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.
Published: 2026-11-05
Score: 7.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 13:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.
Title Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
First Time appeared Redhat
Redhat apicurio Registry
Redhat build Keycloak
Redhat camel Quarkus
Redhat debezium
Redhat exploit Intelligence
Redhat jboss Fuse
Redhat openshift Ai
Redhat openshift Devspaces
Redhat quarkus
Redhat serverless
Weaknesses CWE-862
CPEs cpe:/a:redhat:apicurio_registry:3
cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:camel_quarkus:3
cpe:/a:redhat:debezium:3
cpe:/a:redhat:exploit_intelligence:0
cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:openshift_ai
cpe:/a:redhat:openshift_devspaces:3
cpe:/a:redhat:quarkus:3
cpe:/a:redhat:serverless:1
Vendors & Products Redhat
Redhat apicurio Registry
Redhat build Keycloak
Redhat camel Quarkus
Redhat debezium
Redhat exploit Intelligence
Redhat jboss Fuse
Redhat openshift Ai
Redhat openshift Devspaces
Redhat quarkus
Redhat serverless
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Redhat Apicurio Registry Build Keycloak Camel Quarkus Debezium Exploit Intelligence Jboss Fuse Openshift Ai Openshift Devspaces Quarkus Serverless
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-11-05T16:30:14.324Z

Reserved: 2026-10-09T05:00:24.359Z

Link: CVE-2026-107912

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-05T14:16:59.697

Modified: 2026-11-05T14:16:59.833

Link: CVE-2026-107912

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T14:30:08Z

Weaknesses