Improper access control in Quarkus - CVE-2026-39852
Published: May 5, 2026
Vulnerability identifier: #VU129871
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-39852
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization and access protected resources.
The vulnerability exists due to improper access control in the quarkus security layer and RESTEasy Reactive routing layer when handling HTTP requests containing matrix parameters. A remote attacker can append a semicolon and arbitrary text to the request URL to bypass authorization and access protected resources.
The issue is caused by a path-normalization inconsistency where authorization checks are performed on the raw URL path while routing strips matrix parameters before endpoint matching.
Affected software
Quarkus
Enterprise Build of Quarkus
Red Hat build of Quarkus
Red Hat Camel for Spring Boot
Enterprise Build of Quarkus
Red Hat build of Quarkus
Red Hat Camel for Spring Boot
How to mitigate CVE-2026-39852
Install security update from vendor's website.
Quarkus - addressed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.34.7, 3.35.2
Enterprise Build of Quarkus - update to 3.27.1.SP1
Red Hat build of Quarkus - addressed in versions 3.20.6.SP1, 3.27.3.SP1
Red Hat Camel for Spring Boot - update to 4.14
Enterprise Build of Quarkus - update to 3.27.1.SP1
Red Hat build of Quarkus - addressed in versions 3.20.6.SP1, 3.27.3.SP1
Red Hat Camel for Spring Boot - update to 4.14