What’s Vulnerable › Vulnerabilities

CVE-2023-6394: Quarkus: graphql operations over websockets bypass

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-12-09 · updated 2026-10-20
• Weakness: CWE-862

Description

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.

Affected products

• quarkusio quarkus: before 3.6.0 — fixed in 3.6.0
• Red Hat build of Quarkus: all versions

How to fix

Upgrade to a fixed version: quarkusio quarkus 3.6.0. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2023:7612
• https://access.redhat.com/errata/RHSA-2023:7700
• https://access.redhat.com/security/cve/CVE-2023-6394
• https://bugzilla.redhat.com/show_bug.cgi?id=2252197
• https://access.redhat.com/errata/RHSA-2023:7612
• https://access.redhat.com/security/cve/CVE-2023-6394
• https://bugzilla.redhat.com/show_bug.cgi?id=2252197

Get alerted when CVE-2023-6394 or the next vulnerability affects your stack