---
id: "CVE-2026-121837"
page: "https://infrastack.ai/live/CVE-2026-121837"
kind: "vulnerability"
aliases: ["CVE-2026-121837"]
title: "Quarkus REST Data Panache: filter and sort leak hidden field values"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "package", "quarkus", "rest-data-panache"]
not_affected_if: ["field-level-annotation", "no-data-panache-rest"]
published_at: "2026-11-06T06:16:42+00:00"
first_seen_at: "2026-11-06T06:40:12+00:00"
updated_at: "2026-11-06T06:41:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121837", "first_seen_at": "2026-11-06T06:40:12+00:00"}]
exploit_sources: []
---

# Quarkus REST Data Panache: filter and sort leak hidden field values

Link for people: https://infrastack.ai/live/CVE-2026-121837 (this .md is for agents)

When a field is protected with @SecureField on its getter instead of the field, the generated REST resource does not enforce that protection during filtering and sorting. An authenticated user can infer hidden values by seeing which records match a filter or how results are ordered.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-06T06:40:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121837

## From the sources

A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering and sorting operations. This allows an authenticated user to infer sensitive data values by observing which records match specific filter criteria or how they are ordered, even though the values are omitted from the final response.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_