Key points
- The flaw allows unauthenticated attackers to bypass security controls on generated endpoints.
- Using @MethodProperties without re-declaring roles causes the generator to drop class-level security.
- Red Hat lists the issue as CVSS 9.1 Critical, affecting its build of Quarkus.
A critical vulnerability in Quarkus REST Data Panache allows attackers to bypass security controls without authentication. The flaw affects how the framework generates code for specific operations, potentially leaving endpoints exposed to unauthorized access.
Security researchers have assigned the issue CVE-2026-87744 with a CVSS score of 9.1, rating it as Critical. The weakness stems from a code generation error that silently removes existing security requirements under certain conditions.
How the flaw works
The vulnerability occurs when developers customize a specific operation using the @MethodProperties annotation. If they do not explicitly re-declare security roles during this customisation, the code generator drops the class-level security requirements. This behaviour is classified under CWE-425, which relates to missing required security checks.
According to the National Vulnerability Database, this results in the affected endpoint defaulting to permissive access. Attackers can then reach these endpoints without providing credentials, bypassing the intended security controls entirely.
Who is affected
Red Hat Exploit Intelligence has identified this issue in its Red Hat build of Quarkus. The flaw specifically impacts applications using Quarkus REST Data Panache for generating REST endpoints.
Developers who rely on automatic code generation for their API layers are at risk if they use custom annotations without careful security review. The National Vulnerability Database records confirm that the issue allows unauthenticated users to interact with protected resources.
Our take on the response
That suggests developers must manually verify security constraints whenever they apply custom annotations. The silent dropping of class-level requirements means that standard security assumptions no longer hold for modified methods.
Organisations should audit their codebases for instances where @MethodProperties is used without explicit role re-declaration. Until a fix is confirmed, the risk of unauthorized data modification or disclosure remains high for affected endpoints.
What to do and how to stay safe: Quarkus
- Review all endpoints using @MethodProperties to ensure security roles are explicitly re-declared.
- Audit class-level security requirements to confirm they are not being silently dropped by the generator.
- Monitor Red Hat advisories for updates regarding CVE-2026-87744 and its impact on Quarkus builds.
- Test generated endpoints for unauthenticated access to verify that security controls are functioning as intended.
Step-by-step guide: Out-of-Band Patches: How Emergency Updates Prevent Downtime
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-87744?
It is a critical vulnerability in Quarkus REST Data Panache that allows unauthenticated access to endpoints due to missing security roles.
How does the flaw affect security?
The code generator silently drops class-level security requirements when @MethodProperties is used without re-declaring roles, leading to permissive access.
Which products are affected?
Red Hat build of Quarkus is listed as affected by this vulnerability in the National Vulnerability Database records.