CVE-2026-87744: Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-12 · updated 2026-10-16
Weakness: CWE-425

Description

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.

Affected products

Red Hat Exploit Intelligence: all versions
Red Hat build of Quarkus 3.27.6.redhat: all versions — fixed in 3.27.6.redhat-00004
Red Hat build of Quarkus 3.33.4.redhat: all versions — fixed in 3.33.4.redhat-00004

How to fix

Upgrade to a fixed version: Red Hat build of Quarkus 3.27.6.redhat 3.27.6.redhat-00004; Red Hat build of Quarkus 3.33.4.redhat 3.33.4.redhat-00004. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-87744 or the next vulnerability affects your stack