QUARKUS-VERTX-HTTP · CVE-2026-107912 · Runtime
NO FIX YET
Quarkus's management interface, in the quarkus-vertx-http component, combines the management root path with permission rules incorrectly, so security policies apply to the wrong internal paths. An attacker can bypass intended authorization checks and reach sensitive management endpoints.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Quarkus apps that enable the separate management interface (quarkus.management.enabled=true) and secure it with path-based permission rules combined with a custom management root path. Red Hat lists Build of Quarkus, Fuse, OpenShift Serverless, OpenShift Dev Spaces, OpenShift AI, Build of Keycloak and Build of Apicurio Registry as including the component. Affected and fixed versions are not yet published; teams not running the management interface can likely skip it.
Not affected if default-config, management-interface-disabled
Who cares java, management-interface, quarkus, self-hosted
No fix yet, per the sources.
A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.