Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-17T14:00:00 resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

Red Hat would like to thank Yu Bao (PayPal Cyber Security Team) for reporting this issue. Red Hat build of Apache Camel 4 for Quarkus 3 Affected resteasy-core Red Hat build of Apicurio Registry 3 Fix deferred resteasy-core Red Hat build of Debezium 3 Affected resteasy-core Red Hat Build of Keycloak Affected resteasy-core Red Hat Build of Keycloak Affected rhbk/keycloak-rhel9-operator Red Hat build of Quarkus Affected resteasy-core Red Hat Certificate System 10 Affected redhat-pki:10/redhat-pki Red Hat Certificate System 11 Affected redhat-pki Red Hat Enterprise Linux 10 Affected dogtag-pki Red Hat Enterprise Linux 8 Affected pki-core:10.6/pki-core Red Hat Enterprise Linux 9 Affected jackson-jaxrs-providers Red Hat Enterprise Linux 9 Affected pki-core Red Hat Fuse 7 Fix deferred resteasy-core Red Hat Fuse 7 Fix deferred resteasy-jaxrs Red Hat JBoss Enterprise Application Platform 7 Fix deferred jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Fix deferred jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Fix deferred jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Fix deferred resteasy-jaxrs Red Hat JBoss Enterprise Application Platform 8 Affected resteasy-core Red Hat JBoss Enterprise Application Platform Expansion Pack Affected resteasy-core Red Hat Satellite 6 Affected candlepin Red Hat Single Sign-On 7 Fix deferred resteasy-jaxrs https://www.cve.org/CVERecord?id=CVE-2026-89058 https://nvd.nist.gov/vuln/detail/CVE-2026-89058 https://github.com/resteasy/resteasy/commit/efeb2b7 https://github.com/resteasy/resteasy/security/advisories/GHSA-972r-f3fv-whm3