Log in Start free

Vulnerability · Published Sep 17, 2026 · Assigned by redhat

CVE-2026-81829Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver

Medium 5.3

In plain English

A medium-severity path traversal in Exploit Intelligence from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.6%top 51.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat build of Quarkus 3.27.5.SP2 see references
Red Hat Red Hat build of Quarkus 3.33.3.SP2 see references
Red Hat Exploit Intelligence see references
Red Hat Red Hat build of Apicurio Registry 3 see references
Red Hat Red Hat build of Apicurio Registry 3 see references
Red Hat Red Hat build of Quarkus see references
Red Hat Red Hat JBoss Enterprise Application Platform 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack see references

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References