Log in Start free

Vulnerability · Published Nov 5, 2026 · Assigned by redhat

CVE-2026-107912Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw

High 7.7

In plain English

A high-severity missing authorization in Exploit Intelligence from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.2%top 94.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.

Affected products (as reported)

VendorProductVersions
Red Hat Exploit Intelligence see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 see references
Red Hat Red Hat build of Apicurio Registry 3 see references
Red Hat Red Hat build of Debezium 3 see references
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat build of Quarkus see references
Red Hat Red Hat Fuse 7 see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift Dev Spaces see references

Weakness: CWE-862 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References