Description
A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.
Published: 2026-11-05
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Workaround

--- CME Mitigation Guidance (2026-11-06) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to ensure slash delimiter separation when joining the management root path with permission rules in quarkus-vertx-http to prevent authorization bypass on management endpoints: upgrade to the corresponding fixed Red Hat builds, which inserts a slash delimiter when concatenating the management root path with relative permission rules so policies bind to actual endpoints rather than malformed paths, closing direct HTTP requests to exposed management paths. Until patched, this is a concern on Quarkus applications exposing the management interface to local or private network callers across all platforms, so restrict network and local access to the Quarkus management interface to trusted administrators, preventing untrusted callers from reaching exposed endpoints. As a compensating measure, restrict network access to the port exposing the Quarkus management interface using host-based firewalls such as firewalld or nftables and record administrative actions executed through the management interface and forward logs to a SIEM to detect unauthorized configuration changes. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper path concatenation defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-909 Default-Deny API Authorization Policy (high)

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 05 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 05 Nov 2026 13:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.
Title Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
First Time appeared Redhat
Redhat apicurio Registry
Redhat build Keycloak
Redhat camel Quarkus
Redhat debezium
Redhat exploit Intelligence
Redhat jboss Fuse
Redhat openshift Ai
Redhat openshift Devspaces
Redhat quarkus
Redhat serverless
Weaknesses CWE-862
CPEs cpe:/a:redhat:apicurio_registry:3
cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:camel_quarkus:3
cpe:/a:redhat:debezium:3
cpe:/a:redhat:exploit_intelligence:0
cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:openshift_ai
cpe:/a:redhat:openshift_devspaces:3
cpe:/a:redhat:quarkus:3
cpe:/a:redhat:serverless:1
Vendors & Products Redhat
Redhat apicurio Registry
Redhat build Keycloak
Redhat camel Quarkus
Redhat debezium
Redhat exploit Intelligence
Redhat jboss Fuse
Redhat openshift Ai
Redhat openshift Devspaces
Redhat quarkus
Redhat serverless
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Redhat Apicurio Registry Build Keycloak Camel Quarkus Debezium Exploit Intelligence Jboss Fuse Openshift Ai Openshift Devspaces Quarkus Serverless
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-11-06T19:55:18.512Z

Reserved: 2026-10-09T05:00:24.359Z

Link: CVE-2026-107912

cve-icon Vulnrichment

Updated: 2026-11-05T16:29:52.746Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-05T14:16:59.697

Modified: 2026-11-05T17:17:35.427

Link: CVE-2026-107912

cve-icon Redhat

Severity : Important

Publid Date: 2026-11-05T12:34:20Z

Links: CVE-2026-107912 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T14:30:08Z

Weaknesses