A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Exploit Intelligence | affected | — |
| Red Hat | OpenShift Serverless | affected | — |
| Red Hat | OpenShift Serverless | affected | — |
| Red Hat | OpenShift Serverless | affected | — |
| Red Hat | OpenShift Serverless | affected | — |
| Red Hat | OpenShift Serverless | affected | — |
| Red Hat | OpenShift Serverless | affected | — |
| Red Hat | OpenShift Serverless | affected | — |
| Red Hat | OpenShift Serverless | affected | — |
| Red Hat | OpenShift Serverless | affected | — |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | affected | — |
| Red Hat | Red Hat build of Apicurio Registry 3 | affected | — |
| Red Hat | Red Hat build of Debezium 3 | affected | — |
| Red Hat | Red Hat Build of Keycloak | affected | — |
| Red Hat | Red Hat Build of Keycloak | affected | — |
| Red Hat | Red Hat Build of Keycloak | affected | — |
| Red Hat | Red Hat build of Quarkus | affected | — |
| Red Hat | Red Hat Fuse 7 | unknown | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | affected | — |
| Red Hat | Red Hat OpenShift Dev Spaces | affected | — |
No data.
No data.
No data.
Project Subscriptions
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 05 Nov 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints. | |
| Title | Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw | |
| First Time appeared |
Redhat
Redhat apicurio Registry Redhat build Keycloak Redhat camel Quarkus Redhat debezium Redhat exploit Intelligence Redhat jboss Fuse Redhat openshift Ai Redhat openshift Devspaces Redhat quarkus Redhat serverless |
|
| Weaknesses | CWE-862 | |
| CPEs | cpe:/a:redhat:apicurio_registry:3 cpe:/a:redhat:build_keycloak: cpe:/a:redhat:camel_quarkus:3 cpe:/a:redhat:debezium:3 cpe:/a:redhat:exploit_intelligence:0 cpe:/a:redhat:jboss_fuse:7 cpe:/a:redhat:openshift_ai cpe:/a:redhat:openshift_devspaces:3 cpe:/a:redhat:quarkus:3 cpe:/a:redhat:serverless:1 |
|
| Vendors & Products |
Redhat
Redhat apicurio Registry Redhat build Keycloak Redhat camel Quarkus Redhat debezium Redhat exploit Intelligence Redhat jboss Fuse Redhat openshift Ai Redhat openshift Devspaces Redhat quarkus Redhat serverless |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-11-05T13:27:11.915Z
Reserved: 2026-10-09T05:00:24.359Z
Link: CVE-2026-107912
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses