Incorrect authorization in Quarkus - CVE-2026-107912
Published: November 9, 2026
Vulnerability identifier: #VU162972
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-107912
CWE-ID: CWE-863
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated local attacker to bypass authorization and retrieve protected data from Quarkus management endpoints.
The vulnerability exists due to incorrect concatenation of relative permission paths with a management root lacking a trailing slash when the management interface and its authentication are enabled. An unauthenticated local attacker can reach the management listener and request the intended endpoint, such as /q/secret, while authorization rules protect the incorrectly concatenated path /qsecret instead.
Affected software
Quarkus
How to mitigate CVE-2026-107912
Install security update from vendor's website.
Quarkus - addressed in versions 3.33.4.2, 3.40.1.2