SB2026090286 - Multiple vulnerabilities in Quarkus
Published: September 2, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-12894)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper access control in the ReflectionValueResolver component of the Quarkus Qute template engine when rendering attacker-controlled templates. A remote user can bypass the security filter and construct a reflection chain to execute arbitrary code.
Exploitation requires access to template input and the presence of an Enum instance in the template context.
2) Interpretation Conflict (CVE-ID: CVE-2026-19651)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and alter application behavior by supplying query string parameters that are treated as request headers.
The vulnerability exists due to improper input mapping in SpringWebResteasyReactiveProcessor in quarkus-spring-web when processing @RequestHeader annotations on the quarkus-rest stack. A remote attacker can send a specially crafted request with query string parameters to disclose sensitive information and alter application behavior by supplying query string parameters that are treated as request headers.
Only the quarkus-spring-web extension on the quarkus-rest (RESTEasy Reactive) stack is affected; the classic RESTEasy stack is not affected.
3) Improper access control (CVE-ID: CVE-2026-19625)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication and gain unauthorized access to resources protected by a different OIDC tenant.
The vulnerability exists due to improper access control in the shared token-introspection cache in quarkus-oidc when handling binary access tokens across multiple OIDC provider tenants. A remote attacker can reuse a valid token for one tenant to access an endpoint secured by another tenant to bypass authentication and gain unauthorized access to resources protected by a different OIDC tenant.
The issue occurs only when a token introspection result cache is enabled and multiple endpoints are secured by individual OIDC provider tenants.
Remediation
Install update from vendor's website.