CVE-2026-87743 Red Hat CVE debrief

Who should care

Defenders and security teams responsible for Quarkus deployments should assess exposure and prioritize patching to prevent potential authorization bypass. This includes reviewing and updating security configurations for affected deployments, monitoring for potential unauthorized access to sensitive information, and verifying and patching affected Quarkus deployments.

Why it matters

CVE-2026-87743 allows an unauthenticated attacker to exploit discrepancies in path normalization, potentially leading to unauthorized access to sensitive information. Defenders should prioritize verifying and patching affected Quarkus deployments.

• Potential unauthorized access to sensitive information
• Need to verify and patch affected Quarkus deployments
• Possible security configuration updates required

Technical summary

The vulnerability allows an unauthenticated attacker to craft a URL that the security matcher considers public but is then routed to a protected endpoint, leading to potential unauthorized access to sensitive information. This can occur due to discrepancies in path normalization between the security matcher and HTTP request dispatchers in Quarkus HTTP security. Defenders should prioritize verifying and patching affected Quarkus deployments to prevent potential authorization bypass and unauthorized access to sensitive information.

Defensive priority

Defenders should prioritize verifying and patching affected Quarkus deployments to prevent potential authorization bypass.

Recommended defensive actions

• Verify and apply patches for Quarkus HTTP security
• Review and update security configurations for affected deployments
• Monitor for potential unauthorized access to sensitive information
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is needed. The official CVE Program record and NIST NVD detail page offer source-provided CVE metadata and source-specific vulnerability assessment. However, defenders need to verify and patch affected Quarkus deployments to prevent potential authorization bypass. The evidence limits and known affected scope should be reviewed to ensure proper mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.