Log in Start free

Vulnerability · Published May 9, 2026 · Assigned by GitHub_M

CVE-2026-42333quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations

Medium 6.3

In plain English

A medium-severity information exposure in quarkus-openapi-generator from quarkiverse. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.4%top 65.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security scheme configured for one operation can therefore be applied to a different same-method operation whose path only partially resembles the protected template, causing bearer tokens, API keys, or basic credentials to be sent to unintended endpoints. This issue has been patched in versions 2.11.1-lts, 2.16.0-lts, and 2.17.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenio.quarkiverse.openapi.generator:quarkus-openapi-generator2.16.0-ltsGHSA-fr8f-rwjx-f32v
Mavenio.quarkiverse.openapi.generator:quarkus-openapi-generator2.17.0GHSA-fr8f-rwjx-f32v

Affected products (as reported)

VendorProductVersions
quarkiverse quarkus-openapi-generator < 2.11.1-lts< 2.16.0-lts< 2.17.0

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References