Skip to content
Sign in
7.7 High

CVE-2026-107912 Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw

Description

A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.

CVSS 3.1 detail

Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitable with local access to the machine, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Local
Attack complexity
Low
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Affected products and versions

Product Affected versions Fixed in
Exploit Intelligence Versions not published
OpenShift Serverless Versions not published
Red Hat build of Apache Camel 4 for Quarkus 3 Versions not published
Red Hat build of Apicurio Registry 3 Versions not published
Red Hat build of Debezium 3 Versions not published
Red Hat Build of Keycloak Versions not published
Red Hat build of Quarkus Versions not published
Red Hat Fuse 7 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Show the other branch
Product Affected versions Fixed in
Red Hat OpenShift Dev Spaces Versions not published

Other CVEs of Exploit Intelligence

The 29 CVEs of Exploit Intelligence →
CVE-2026-121837 Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort 4.3 Medium CVE-2026-114236 Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers 3.3 Low CVE-2026-87744 A flaw was found in Quarkus REST Data Panache 9.1 Critical CVE-2026-94451 Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities 6.5 Medium
Track this CVE