CVE-2026-89058 Red Hat CVE debrief

Who should care

Defenders and security teams responsible for RESTEasy deployments, especially those using the CorsFilter, should assess exposure and verify configurations to prevent credentialed cross-origin requests from untrusted sources.

Why it matters

CVE-2026-89058 flaw in RESTEasy's CorsFilter allows credentialed cross-origin requests, risking confidentiality; defenders should verify configurations and restrict origins to prevent unauthorized access.

• Potential loss of confidentiality through credentialed cross-origin requests
• Need to verify and adjust cross-origin resource sharing configurations
• Risk of unauthorized access to authenticated responses from victim sessions

Technical summary

The CVE-2026-89058 flaw in RESTEasy's CorsFilter, when configured to allow all origins, reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

Defensive priority

Defenders should prioritize verifying and adjusting cross-origin resource sharing configurations, especially for RESTEasy's CorsFilter, to restrict origins and prevent credentialed requests from untrusted sources.

Recommended defensive actions

• Verify and adjust cross-origin resource sharing configurations for RESTEasy's CorsFilter
• Restrict origins to prevent credentialed requests from untrusted sources
• Monitor for and respond to potential credentialed cross-origin requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the flaw in RESTEasy's CorsFilter, its potential impact on confidentiality, and reference links to vendor advisories and issue trackers. The flaw allows credentialed cross-origin requests, risking confidentiality. Defenders should verify configurations and restrict origins to prevent unauthorized access. Evidence is limited to CVE and NVD entries; further verification is needed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.