7.7
High
CVE-2026-107912 Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
Description
A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.
CVSS 3.1 detail
Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitable with local access to the machine, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Exploit Intelligence | Versions not published | |
| OpenShift Serverless | Versions not published | |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Versions not published | |
| Red Hat build of Apicurio Registry 3 | Versions not published | |
| Red Hat build of Debezium 3 | Versions not published | |
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat build of Quarkus | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published |
Show the other branch Hide the other branch
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Dev Spaces | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2548364 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Exploit Intelligence
The 28 CVEs of Exploit Intelligence →
CVE-2026-114236
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a…
3.3
Low
CVE-2026-87744
A flaw was found in Quarkus REST Data Panache
9.1
Critical
CVE-2026-94451
Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities
6.5
Medium
CVE-2026-94449
Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service
7.5
High