CVE-2026-87744 is a critical (CVSS 9.1) flaw in Quarkus REST Data Panache: when a generated endpoint is customized with @MethodProperties, it can lose its class-level security requirements and become reachable without authentication.
What Is It
The flaw is in the code generator for Quarkus REST Data Panache. Developers can customize a specific operation with @MethodProperties. If they do this without also re-declaring the security roles, the generator silently drops the class-level security requirements for that operation. The affected endpoint then defaults to open access with no authentication.
Red Hat ([email protected]) assigned the CVE and classified the weakness as CWE-425. NVD published the record on 2026-10-12 with the status "Received."
Why It Matters
Red Hat rates the flaw 9.1 CRITICAL with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Impact: High confidentiality, high integrity, no availability impact
An attacker with no credentials could read or change data through an endpoint the developer believed was protected. The failure is silent: the class-level security annotations are still visible in the code, so a code review may not catch the missing protection.
Exploitation status: CVE-2026-87744 is not listed in the CISA Known Exploited Vulnerabilities catalog, so CISA has not confirmed active exploitation. No public exploit details have been reported.
What's Vulnerable
Red Hat lists these products as affected:
- Red Hat build of Quarkus 3: package
quarkus-hibernate-orm-rest-data-panache(cpe:/a:redhat:quarkus:3) - Red Hat Exploit Intelligence: package
exploit-intelligence/agent-client-rhel9(cpe:/a:redhat:exploit_intelligence:0)
The flaw is triggered only by a specific setup: a REST Data Panache resource with class-level security, where at least one operation is customized with @MethodProperties and roles are not re-declared on that operation.
Patch Status
The NVD record does not name fixed versions or patched packages, and there is no KEV-required action. Check the Red Hat advisory and Bugzilla entry below for fix availability.
Until a fix is applied, teams using REST Data Panache should:
- Find every resource that uses
@MethodPropertiestogether with class-level security. - Re-declare the security roles explicitly on each customized operation.
Without those roles, the affected endpoints may be serving requests from anyone.