CVE-2026-81829 Red Hat CVE debrief

Who should care

Defenders responsible for configuring and securing SmallRye JWT's AwsAlbKeyResolver, as well as those responsible for monitoring and responding to potential security incidents on the same origin, should assess exposure and prioritize verification of the configured key endpoint and non-public endpoints or internal data.

Why it matters

A flaw in SmallRye JWT's AwsAlbKeyResolver allows an unauthenticated remote attacker to potentially read non-public endpoints or internal data on the same origin before JWT signature verification, requiring defenders to verify the configured key endpoint and assess exposure.

• Potential unauthorized access to non-public endpoints or internal data on the same origin
• Possible reading of sensitive data before JWT signature verification
• Need for verification of configured key endpoint and exposure of non-public endpoints or internal data
• Potential for increased monitoring and incident response due to unauthorized access

Technical summary

The AwsAlbKeyResolver in SmallRye JWT directly concatenates the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators, allowing an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. This vulnerability enables the attacker to potentially read non-public endpoints or internal data before JWT signature verification takes place. The affected product is SmallRye JWT, and defenders should focus on verifying the configured key endpoint and assessing exposure of non-public endpoints or internal data on the same origin.

Defensive priority

Defenders should prioritize verifying the configured key endpoint and assessing exposure of non-public endpoints or internal data on the same origin.

Recommended defensive actions

• Verify the configured key endpoint and assess exposure of non-public endpoints or internal data on the same origin.
• Review and update the AWS_ALB key provider configuration to prevent path traversal and query-string separator injection.
• Monitor for and respond to potential unauthorized access to non-public endpoints or internal data.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE description and NVD detail page provide information on the flaw and its potential impact. The vulnerability is caused by the lack of sanitization of path traversal characters or query-string separators in the AwsAlbKeyResolver of SmallRye JWT. This allows an unauthenticated remote attacker to potentially read non-public endpoints or internal data on the same origin before JWT signature verification. The official CVE Program record and NIST NVD detail page offer additional context and details on the vulnerability. Defenders

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.