[ CVE-2026-87744 · Published 12 Oct 2026 ]
Vulnerability in Red Hat build of Quarkus 3.27.6.redhat
CVSS 9.1
EPSS <1%No fix listed yet
[ Why it matters ]Priority signals
- Critical severity: CVSS 9.1
[ Description ]Official description
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.