Quarkus REST Data Panache Flaw Drops Security Roles for Unauthenticated Access
A critical vulnerability in Quarkus REST Data Panache allows attackers to bypass security controls on generated endpoints due to silent role dropping.
Key points
- CVE-2026-87744 is rated Critical with a CVSS score of 9.1.
- The flaw affects Red Hat build of Quarkus and Quarkus REST Data Panache.
- Developers who customize operations without re-declaring roles face exposed endpoints.
A critical security vulnerability has been identified in Quarkus REST Data Panache that allows unauthenticated attackers to bypass security controls on generated endpoints. According to the National Vulnerability Database record for CVE-2026-87744, this flaw enables unauthorized access by silently dropping class-level security requirements when developers customize specific operations using @MethodProperties without explicitly re-declaring security roles.
At a glance
- CVE
- CVE-2026-87744
- Product
- Red Hat Exploit Intelligence
- CVSS
- 9.1 Critical
- Weakness
- CWE-425
- Exploited
- No known exploitation
The vulnerability is rated Critical with a CVSS score of 9.1, indicating severe risk. The National Vulnerability Database lists the weakness as CWE-425. Red Hat Exploit Intelligence and Red Hat build of Quarkus are listed as affected products in the source material.
Context and Background
The issue arises from how the code generator handles security annotations during customization. When a developer customizes a specific operation using the @MethodProperties annotation, the system expects explicit re-declaration of security roles. If these roles are not explicitly re-declared, the code generator silently drops the class-level security requirements that were previously in place.
This behavior results in the affected endpoint defaulting to permissive, unauthenticated access. The National Vulnerability Database description states that this can potentially lead to unauthorized information disclosure or data modification. The flaw is described in the source material as a finding in Quarkus REST Data Panache that affects generated endpoints.
Who Is Affected
Red Hat build of Quarkus is explicitly listed as an affected product in the National Vulnerability Database record. Developers using Quarkus REST Data Panache who utilize @MethodProperties for customization are at risk if they do not manually re-declare security roles for each customized operation. The vulnerability impacts any application where this specific pattern of customization occurs without corresponding security re-annotation.
No specific version numbers are provided in the source material, but the presence of the flaw in Red Hat build of Quarkus indicates potential exposure among users of this framework. The National Vulnerability Database does not list other vendors or specific software versions beyond the general product names.
What should you do?
Organizations should audit their Quarkus applications for instances where @MethodProperties are used without explicit security role re-declaration. Developers should verify that class-level security requirements are maintained after customization. Teams should monitor vendor announcements for patches or mitigation guidance.
What to do and how to stay safe: Quarkus
- Review all Quarkus REST Data Panache endpoints customized with @MethodProperties to ensure security roles are explicitly re-declared.
- Audit application logs for unauthorized access attempts to endpoints that should be protected but may now be permissive.
- Monitor Red Hat and Quarkus security advisories for updates or patches addressing CVE-2026-87744.
- Implement network-level access controls to limit exposure of potentially vulnerable endpoints while awaiting a vendor fix.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-87744?
CVE-2026-87744 is a critical vulnerability in Quarkus REST Data Panache that allows unauthenticated attackers to bypass security controls on generated endpoints by silently dropping class-level security requirements.
Which products are affected by this vulnerability?
The National Vulnerability Database lists Red Hat build of Quarkus and Quarkus REST Data Panache as affected products.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-87744 as Critical with a CVSS score of 9.1.
