Quarkus REST Data Panache: Missing authorization on generated endpoints
Summary
Quarkus REST Data Panache generates CRUD REST endpoints from entities or repositories. If a developer customizes an operation with @MethodProperties without re-declaring security roles, the code generator drops the class-level security requirement, so the endpoint becomes accessible without authentication. An unauthenticated remote attacker can then potentially read or modify data exposed through the affected endpoint.
Affected
- Red Hat build of Quarkus 3.27.x: versions before 3.27.6.redhat-00004 (per CVE record; default status affected)
- Red Hat build of Quarkus 3.33.x: versions before 3.33.4.redhat-00004 (per CVE record; default status affected)
- Only applications using io.quarkus:quarkus-hibernate-orm-rest-data-panache with @MethodProperties on secured resources
- Upstream Quarkus versions: Unknown.
Fixed in
- Red Hat build of Quarkus 3.27.6.redhat-00004 and later (per CVE record)
- Red Hat build of Quarkus 3.33.4.redhat-00004 and later (per CVE record)
- Upstream fixed version: Unknown.
Workaround
- Restrict network access to Quarkus applications that use REST Data Panache to trusted networks or localhost, using firewall rules or network access controls (Red Hat guidance).
- Until patched, review each @MethodProperties customization and re-declare the required roles on it.
- A restart may be required after network configuration changes.
Exploitation
- No evidence of exploitation in the wild found; not listed in CISA KEV.
- No public proof-of-concept reported.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- EPSS about 0.0029 (as shown on Vulners).
Our recommendation
- Identify Quarkus applications that use REST Data Panache with @MethodProperties, especially internet-facing APIs.
- Apply the fixed Red Hat build of Quarkus versions listed in RHSA-2026:83082 or RHSA-2026:83520 and verify the fixed version for your stream.
- Until patched, restrict network access to trusted networks.
- Test that unauthenticated requests to affected endpoints are rejected.
- Monitor logs of these endpoints for unexpected access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page CVE-2026-87744 access.redhat.com
- RHSA-2026:83082 Red Hat build of Quarkus 3.27.6 access.redhat.com
- RHSA-2026:83520 Red Hat build of Quarkus 3.33.4 access.redhat.com
- Red Hat Bugzilla 2530524 bugzilla.redhat.com
- Quarkus 3.33.4 release blog quarkus.io
- Strix CVE-2026-87744 www.strix.ai
- VulDB 417191 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:54.
Original description (NVD)
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.