Quarkus REST Data Panache Annotation Flaw Triggers CVSS 9.1 Critical Severity CVE-2026-87744

A critical vulnerability in Quarkus REST Data Panache allows unauthenticated attackers to bypass security controls on generated endpoints. The flaw, tracked as CVE-2026-87744, stems from how the framework handles customizations. When developers modify operations using the @MethodProperties annotation, they must explicitly re-declare security roles. If they fail to do so, the code generator removes existing class-level security requirements, leaving the endpoint open to unauthorized access.

Root cause

The issue arises during the code generation process within Quarkus REST Data Panache. According to the NVD record, the weakness is classified as CWE-425. The code generator does not preserve class-level security constraints when a specific operation is customized via @MethodProperties. This behavior occurs silently, meaning developers may not realize their security controls have been stripped from the affected endpoints. The result is a configuration that defaults to permissive access.

Attack path

Attackers can exploit this flaw by targeting endpoints that were customized with @MethodProperties but lacked explicit role re-declarations. Because the security controls are dropped, these endpoints become accessible without authentication. This exposure potentially allows unauthorized information disclosure or data modification. The NVD description notes that the vulnerability enables unauthenticated users to bypass intended security measures, compromising the confidentiality and integrity of the data handled by those specific API routes.

Affected versions

The vulnerability impacts Red Hat build of Quarkus products. The NVD record identifies Red Hat Exploit Intelligence as a source for affected product information. Organizations using Quarkus REST Data Panache should verify if their deployments utilize the @MethodProperties annotation for endpoint customization. Any instance where security roles were not explicitly re-declared in these customizations is likely vulnerable to this bypass technique.

Mitigation

• Review all endpoints customized with @MethodProperties in Quarkus applications.
• Ensure security roles are explicitly re-declared in every customized operation.
• Verify that class-level security requirements are not silently dropped.
• Monitor for unauthorized access attempts on previously secured endpoints.

What to do and how to stay safe: Quarkus

• Audit your Quarkus codebase for uses of @MethodProperties annotations.
• Check that security roles are explicitly defined in each customized method.
• Monitor logs for unauthenticated access to sensitive API endpoints.
• Wait for vendor updates while implementing compensating controls like WAF rules.

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-87744?

It is a critical vulnerability in Quarkus REST Data Panache that allows unauthenticated access to endpoints when security roles are not re-declared with @MethodProperties.

How severe is this vulnerability?

The NVD rates it as Critical with a CVSS score of 9.1.

Which products are affected?

Red Hat build of Quarkus is listed as affected in the NVD record.