Key points
- CVE-2026-87744 is rated CVSS 9.1 Critical severity by the NVD.
- The flaw allows unauthenticated users to access endpoints that should be protected.
- Red Hat lists its build of Quarkus as affected by this vulnerability.
An unauthenticated attacker can bypass security controls on generated endpoints in Quarkus REST Data Panache due to CVE-2026-87744. This flaw allows adversaries to access restricted functions without credentials, potentially leading to data modification or disclosure.
The vulnerability arises when developers customise operations using @MethodProperties without explicitly re-declaring security roles. The code generator then silently drops class-level security requirements. This causes the affected endpoint to default to permissive, unauthenticated access, according to the NVD record.
Technical context
The issue is classified under CWE-425, which relates to permissive regular expressions or similar logic errors in this context of dropped constraints. The flaw exists within the code generation process of Quarkus REST Data Panache. It specifically impacts endpoints where developers have applied customisation annotations but failed to maintain the original security posture.
Affected systems
Red Hat has identified its Red Hat build of Quarkus as affected by this vulnerability. The NVD record lists Red Hat Exploit Intelligence as a source for the advisory. No other vendors or specific version numbers are detailed in the provided source material as being impacted by CVE-2026-87744.
What happens next
No patch or fix has been confirmed yet in the source material. Security teams should monitor vendor channels for updates regarding Red Hat builds of Quarkus. Until a mitigation is available, organisations should assess their exposure by reviewing endpoints that use @MethodProperties annotations.
Why this attack works
This scenario illustrates a common class of defect where automated code generation fails to propagate security constraints from parent classes to child methods. When developers add specific annotations to override default behaviours, the generator may not inherit the original access controls. This creates a gap where the new method appears to the runtime as having no security requirements. Teams usually encounter this when refactoring or customising standard library functions. The weakness serves the initial access or privilege escalation stage of an intrusion, allowing an attacker to reach sensitive data without needing valid credentials or tokens first.
What to do and how to stay safe: Quarkus
- Review all endpoints in Quarkus applications that use @MethodProperties to ensure security roles are explicitly re-declared.
- Audit code generation outputs to verify that class-level security constraints are preserved in generated methods.
- Monitor Red Hat advisories for official patches or workarounds for CVE-2026-87744.
- Implement runtime monitoring to detect unauthenticated access attempts to previously secured endpoints.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-87744?
The National Vulnerability Database rates CVE-2026-87744 as Critical with a CVSS score of 9.1.
Which products are affected by this flaw?
Red Hat lists its Red Hat build of Quarkus as affected by this vulnerability.
How does an attacker exploit this vulnerability?
An attacker can exploit this by accessing endpoints where developers used @MethodProperties without re-declaring security roles, bypassing authentication.
