SB2026090286 - Multiple vulnerabilities in Quarkus



SB2026090286 - Multiple vulnerabilities in Quarkus

Published: September 2, 2026

Security Bulletin ID SB2026090286
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2026-12894)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper access control in the ReflectionValueResolver component of the Quarkus Qute template engine when rendering attacker-controlled templates. A remote user can bypass the security filter and construct a reflection chain to execute arbitrary code.

Exploitation requires access to template input and the presence of an Enum instance in the template context.


2) Interpretation Conflict (CVE-ID: CVE-2026-19651)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and alter application behavior by supplying query string parameters that are treated as request headers.

The vulnerability exists due to improper input mapping in SpringWebResteasyReactiveProcessor in quarkus-spring-web when processing @RequestHeader annotations on the quarkus-rest stack. A remote attacker can send a specially crafted request with query string parameters to disclose sensitive information and alter application behavior by supplying query string parameters that are treated as request headers.

Only the quarkus-spring-web extension on the quarkus-rest (RESTEasy Reactive) stack is affected; the classic RESTEasy stack is not affected.


3) Improper access control (CVE-ID: CVE-2026-19625)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication and gain unauthorized access to resources protected by a different OIDC tenant.

The vulnerability exists due to improper access control in the shared token-introspection cache in quarkus-oidc when handling binary access tokens across multiple OIDC provider tenants. A remote attacker can reuse a valid token for one tenant to access an endpoint secured by another tenant to bypass authentication and gain unauthorized access to resources protected by a different OIDC tenant.

The issue occurs only when a token introspection result cache is enabled and multiple endpoints are secured by individual OIDC provider tenants.


Remediation

Install update from vendor's website.