{"id":"CVE-2026-107912","kind":"vulnerability","aliases":["CVE-2026-107912"],"related":[],"title":"Quarkus: management root path mixup lets attackers bypass endpoint authorization","description":"A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.","summary":"Quarkus's management interface, in the quarkus-vertx-http component, combines the management root path with permission rules incorrectly, so security policies apply to the wrong internal paths. An attacker can bypass intended authorization checks and reach sensitive management endpoints.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"quarkus-vertx-http","fixed":[],"affected":"unknown","ecosystem":"maven"}],"ecosystems":[],"tags":["java","management-interface","quarkus","runtime","self-hosted"],"not_affected_if":["default-config","management-interface-disabled"],"how_to_check":"Check whether the app sets quarkus.management.enabled=true (build-time) AND uses quarkus.management.root-path with quarkus.management.auth.permission.* rules; if the management interface is not enabled, you are likely not exposed. Affected versions are not yet published: check the Quarkus GitHub security advisories and Red Hat CVE page for a fixed release.","fix":null,"status":"open","published_at":"2026-11-05T14:16:59+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","triaged_at":"2026-11-05T14:40:20+00:00","updated_at":"2026-11-05T14:43:32+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-05T14:40:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Quarkus: management root path mixup lets attackers bypass endpoint authorization","impact":"medium","summary":"Quarkus's management interface, in the quarkus-vertx-http component, combines the management root path with permission rules incorrectly, so security policies apply to the wrong internal paths. An attacker can bypass intended authorization checks and reach sensitive management endpoints.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["quarkus","java","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized access to sensitive management endpoints","analyst_note":"Find affected Quarkus version ranges and fixed versions, and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107912, to confirm the default configuration.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["management-interface-disabled"],"who_is_affected":"Applications built on Quarkus that expose the management interface and use path-based permission rules on it are the ones to look at. The sources do not state which versions are affected or whether a default configuration is exposed. Teams that do not run the Quarkus management interface are likely not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000671,"input_tokens":4253,"output_tokens":491,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Quarkus version ranges and fixed versions, and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107912, to confirm the default configuration.","search":"'-107912':13A,16A '-2026':12A,15A 'access':134C 'appli':53B,115C 'attack':7A,60B,125C 'author':10A,64B,129C 'bypass':8A,62B,127C 'check':65B,130C 'combin':41B,98C 'compon':40B,90C 'cve':11A,14A 'endpoint':9A,70B,138C 'flaw':72C 'found':74C 'framework':82C,96C 'gain':132C 'host':29B 'http':20A,39B,89C 'incorrect':49B,97C 'intend':63B,128C 'interfac':24B,33B,78C 'intern':57B,119C 'issu':92C 'java':21B 'lead':107C 'let':6A 'manag':2A,23B,32B,43B,69B,77C,100C,137C 'management-interfac':22B 'mixup':5A 'occur':93C 'path':4A,45B,58B,102C,120C 'permiss':47B,105C 'polici':52B,113C 'quarkus':1A,18A,25B,30B,37B,81C,87C 'quarkus-vertx-http':17A,36B,86C 'reach':67B 'result':123C 'root':3A,44B,101C 'rule':48B,106C 'runtim':26B 'secur':51B,112C 'self':28B 'self-host':27B 'sensit':68B,136C 'situat':110C 'specif':83C,104C 'unauthor':133C 'vertx':19A,38B,88C 'within':84C 'wrong':56B,118C","nicknames":[],"mitigations":[],"who_affected":"Quarkus apps that enable the separate management interface (quarkus.management.enabled=true) and secure it with path-based permission rules combined with a custom management root path. Red Hat lists Build of Quarkus, Fuse, OpenShift Serverless, OpenShift Dev Spaces, OpenShift AI, Build of Keycloak and Build of Apicurio Registry as including the component. Affected and fixed versions are not yet published; teams not running the management interface can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["quarkusvertxhttp"],"ptokens":["http","quarkus","vertx"],"labels":["high","java","managementinterface","quarkus","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107912","severity":null,"published_at":"2026-11-05T14:16:59+00:00","modified_at":"2026-11-05T14:16:59+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","fetched_at":"2026-11-05T14:39:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107912:1789","url":"https://access.redhat.com/security/cve/CVE-2026-107912","severity":null,"published_at":"2026-11-05T14:43:32+00:00","modified_at":"2026-11-05T14:43:32+00:00","first_seen_at":"2026-11-05T14:43:32+00:00","fetched_at":"2026-11-05T14:43:32+00:00","note":"Red Hat CNA page read (description, Important, CVSS 7.7 AV:L, CWE-862, Bugzilla 2548364). No Quarkus GHSA, version range or fixed version published yet; Red Hat lists affected products (Build of Quarkus, Fuse, OpenShift Serverless/Dev Spaces/AI, Keycloak, Apicurio) but no versions on page. Not verified: nothing in vendor words on fix. Revisit when upstream GHSA/release appears.","cites":["https://access.redhat.com/security/cve/CVE-2026-107912","https://quarkus.io/guides/management-interface-reference"]}],"documents":[{"id":77003,"url":"https://access.redhat.com/security/cve/CVE-2026-107912","title":"Red Hat CVE-2026-107912","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":77004,"url":"https://quarkus.io/guides/management-interface-reference","title":"Quarkus management interface reference","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}