Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-17T13:10:22 quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-551

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

This is an Important flaw as it allows unauthenticated attackers to bypass path-based access control rules in Quarkus HTTP security. The discrepancy in path normalization between the security matcher and HTTP request dispatchers could lead to unauthorized access to protected endpoints in applications deployed with Quarkus. Red Hat would like to thank Michael Read (https://github.com/Michael-JRead) for reporting this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Exploit Intelligence Under investigation exploit-intelligence/agent-client-rhel9 OpenShift Serverless Under investigation openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 OpenShift Serverless Under investigation openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9 OpenShift Serverless Under investigation openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9 OpenShift Serverless Under investigation openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9 OpenShift Serverless Under investigation openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9 OpenShift Serverless Under investigation openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9 OpenShift Serverless Under investigation openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9 OpenShift Serverless Under investigation openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9 Red Hat build of Apache Camel 4 for Quarkus 3 Out of support scope quarkus-vertx-http Red Hat build of Apicurio Registry 3 Out of support scope quarkus-vertx-http Red Hat build of Debezium 3 Out of support scope quarkus-vertx-http Red Hat Build of Keycloak Out of support scope keycloak/rhbk-openshift-rhel9 Red Hat Build of Keycloak Out of support scope keycloak/rhbk-rhel9-operator Red Hat Build of Keycloak Out of support scope quarkus-vertx-http Red Hat Build of Keycloak Out of support scope rhbk/keycloak-rhel9 Red Hat Build of Keycloak Out of support scope rhbk/keycloak-rhel9-operator Red Hat Fuse 7 Out of support scope quarkus-vertx-http Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-trustyai-service-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/multicluster-redirector-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-87743 https://nvd.nist.gov/vuln/detail/CVE-2026-87743