Log in Start free

Vulnerability · Published Sep 18, 2026 · Assigned by redhat

CVE-2026-87743Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

High 7.5

In plain English

A high-severity security flaw in Exploit Intelligence from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 55.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat build of Quarkus 3.27.5.SP2 see references
Red Hat Red Hat build of Quarkus 3.33.3.SP2 see references
Red Hat Red Hat OpenShift Dev Spaces 3.31 see references
Red Hat Exploit Intelligence see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 see references
Red Hat Red Hat build of Apicurio Registry 3 see references
Red Hat Red Hat build of Debezium 3 see references
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat Fuse 7 see references
Red Hat Red Hat OpenShift AI (RHOAI) see references

Weakness: CWE-551 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References