---
id: "CVE-2026-107912"
kind: "vulnerability"
aliases: ["CVE-2026-107912"]
title: "Quarkus: management root path mixup lets attackers bypass endpoint authorization"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "quarkus-vertx-http", "fixed": [], "affected": "unknown", "ecosystem": "maven"}]
ecosystems: []
tags: ["java", "management-interface", "quarkus", "runtime", "self-hosted"]
not_affected_if: ["default-config", "management-interface-disabled"]
published_at: "2026-11-05T14:16:59+00:00"
first_seen_at: "2026-11-05T14:39:17+00:00"
updated_at: "2026-11-05T14:43:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107912", "first_seen_at": "2026-11-05T14:39:17+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-107912", "first_seen_at": "2026-11-05T14:43:32+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-107912", "https://quarkus.io/guides/management-interface-reference"]}]
exploit_sources: []
---

# Quarkus: management root path mixup lets attackers bypass endpoint authorization

Quarkus's management interface, in the quarkus-vertx-http component, combines the management root path with permission rules incorrectly, so security policies apply to the wrong internal paths. An attacker can bypass intended authorization checks and reach sensitive management endpoints.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:quarkus-vertx-http affected unknown fixed no fixed version listed

## How to check

Check whether the app sets quarkus.management.enabled=true (build-time) AND uses quarkus.management.root-path with quarkus.management.auth.permission.* rules; if the management interface is not enabled, you are likely not exposed. Affected versions are not yet published: check the Quarkus GitHub security advisories and Red Hat CVE page for a fixed release.

## Timeline

- 2026-11-05T14:39:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107912
- 2026-11-05T14:43:32+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-107912 — Red Hat CNA page read (description, Important, CVSS 7.7 AV:L, CWE-862, Bugzilla 2548364). No Quarkus GHSA, version range or fixed version published yet; Red Hat lists affected products (Build of Quarkus, Fuse, OpenShift Serverless/Dev Spaces/AI, Keycloak, Apicurio) but no versions on page. Not verified: nothing in vendor words on fix. Revisit when upstream GHSA/release appears.

## Documents

- [advisory] Red Hat CVE-2026-107912 https://access.redhat.com/security/cve/CVE-2026-107912
- [mentions] Quarkus management interface reference https://quarkus.io/guides/management-interface-reference

## From the sources

A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_