CVE-2026-87743: Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-18 · updated 2026-10-29
Weakness: CWE-551

Description

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

Affected products

Red Hat OpenShift Dev Spaces 3.31: all versions — fixed in 1792491532

How to fix

Upgrade to a fixed version: Red Hat OpenShift Dev Spaces 3.31 1792491532. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-87743 or the next vulnerability affects your stack