CVE-2026-81829 Red Hat CVE debrief

Who should care

Defenders responsible for Red Hat build of Quarkus and related products should assess exposure and prioritize patching or mitigation efforts. This includes administrators and security teams managing these systems.

Why it matters

CVE-2026-81829 is a medium-severity vulnerability in SmallRye JWT's AwsAlbKeyResolver that allows unauthenticated same-origin SSRF attacks. Defenders should prioritize verifying affected versions and applying patches to prevent potential unauthorized access and disruption of service.

• Potential unauthorized access to non-public endpoints or internal data
• Possible disruption of service due to arbitrary GET requests
• Need for verification of affected versions and application of patches
• Potential for SSRF attacks on the same origin as the configured key endpoint

Technical summary

The vulnerability is caused by the lack of sanitization of the kid header value in the AwsAlbKeyResolver, which allows an attacker to construct a key-fetch URL by directly concatenating the attacker-controlled kid header value without sanitizing path traversal characters or query-string separators. This issue affects applications using SmallRye JWT's AwsAlbKeyResolver to verify JSON Web Tokens signed by AWS Application Load Balancers, potentially allowing unauthenticated same-origin SSRF attacks. Defenders should prioritize verifying affected versions and applying patches to prevent potential unauthorized access and disruption of service.

Defensive priority

Defenders should prioritize verifying the affected versions of Red Hat build of Quarkus and other related products, and applying patches or mitigations as available.

Recommended defensive actions

• Verify the affected versions of Red Hat build of Quarkus and other related products
• Apply patches or mitigations as available
• Monitor for potential exploitation attempts
• Review and update configurations for AwsAlbKeyResolver
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on the vulnerability, including its description, CVSS score, and affected products. Red Hat has provided errata and security advisories related to this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.