Skip to content
OpenAdvisories
High · 7.7 CVE-2026-107912 EUVD-2026-117440GHSA-4547-585x-4r9w

Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw

Published Nov 5, 2026 · Updated Nov 6, 2026 · Assigned by redhat

Description

A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.

Affected products

VendorProductAffectedFixed
Red Hat Exploit Intelligence — —
Red Hat OpenShift Serverless — —
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 — —
Red Hat Red Hat build of Apicurio Registry 3 — —
Red Hat Red Hat build of Debezium 3 — —
Red Hat Red Hat Build of Keycloak — —
Red Hat Red Hat build of Quarkus — —
Red Hat Red Hat Fuse 7 — —
Red Hat Red Hat OpenShift AI (RHOAI) — —
Red Hat Red Hat OpenShift Dev Spaces — —

References