Quarkus management interface authorization bypass via path concatenation flaw in quarkus-vertx-http

Attackers can get into the management features of Java programs without a password.

Summary

The Quarkus framework incorrectly combines the management root path with permission rules, so security policies apply to the wrong internal paths. An attacker can bypass authorization checks and reach sensitive management endpoints, and several Red Hat products that use this component are affected.

What to do

We have not confirmed a fixed version yet. Check the source links below.

Products and platforms

Exploit Intelligence
OpenShift Serverless
Red Hat build of Apache Camel 4 for Quarkus 3
Red Hat build of Apicurio Registry 3
Red Hat build of Debezium 3
Red Hat Build of Keycloak
Red Hat build of Quarkus
Red Hat Fuse 7
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Dev Spaces

CVE IDs

CVE-2026-107912 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-05 13:27 UTC

First seen 2026-11-09 16:40 UTC