CVE-2026-89058 Red Hat CVE debrief

Who should care

Defenders responsible for Red Hat build of Apache Camel 4 for Quarkus 3 deployments, especially those exposed to untrusted or internet-facing networks, should assess their exposure and prioritize remediation.

Why it matters

CVE-2026-89058 allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, potentially leading to a loss of confidentiality. Defenders should prioritize verifying and remediating this vulnerability in Red Hat build of Apache Camel 4 for Quarkus 3 deployments, especially those exposed to untrusted or internet-facing networks.

• Potential loss of confidentiality due to credentialed cross-origin requests.
• Possible unauthorized access to authenticated responses from a victim's session.
• Need for verification of affected versions and deployments.
• Priority for updating and restricting CorsFilter configurations.

Technical summary

The RESTEasy CorsFilter, when configured to allow all origins (('*')), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session. The vulnerability affects Red Hat build of Apache Camel 4 for Quarkus 3 deployments. Defenders should prioritize verifying and remediating this vulnerability, especially in deployments exposed to untrusted or internet-facing networks.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Red Hat build of Apache Camel 4 for Quarkus 3 deployments, especially those exposed to untrusted or internet-facing networks.

Recommended defensive actions

• Verify the configuration of RESTEasy's CorsFilter in Red Hat build of Apache Camel 4 for Quarkus 3 deployments.
• Restrict the allowed origins to specific domains instead of using '*'
• Implement additional security measures to monitor and limit cross-origin requests.
• Review and update the deployment's security policies and configurations.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but its exploitation and impact require further verification from official sources. The RESTEasy CorsFilter issue allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session. Official sources, including the CVE Program record and NIST NVD detail page, confirm the vulnerability's existence and provide guidance on affected versions and deployments. However, the full scope of affected systems and potential

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.