Key points
- Quarkus REST Data Panache code generator drops class-level security requirements when developers use @MethodProperties without re-declaring roles.
- The vulnerability, CVE-2026-87744, is rated CVSS 9.1 Critical and allows unauthenticated access to endpoints that should be protected.
- Red Hat lists its build of Quarkus as affected by this issue, which could lead to unauthorized information disclosure or data modification.
A critical vulnerability has been identified in Quarkus REST Data Panache, a framework component used for building RESTful APIs. This flaw, tracked as CVE-2026-87744, allows unauthenticated attackers to bypass security controls on generated endpoints, potentially leading to unauthorized data access or modification.
What happened
The National Vulnerability Database records CVE-2026-87744 with a CVSS score of 9.1, classifying it as Critical. The issue stems from how the Quarkus code generator handles security annotations when developers customize specific operations. According to the NVD record, the weakness is categorised under CWE-425. This flaw specifically affects the Quarkus REST Data Panache module, which is designed to simplify the creation of REST endpoints.
When a developer uses the @MethodProperties annotation to customize a specific operation, they must explicitly re-declare security roles. The NVD description states that if developers fail to re-declare these roles, the code generator silently drops class-level security requirements. This behaviour effectively removes the intended security barriers for that specific endpoint. Red Hat Exploit Intelligence and Red Hat’s build of Quarkus are listed as affected products in the NVD record.
The result is that the affected endpoint defaults to permissive, unauthenticated access. Attackers do not need valid credentials to interact with these endpoints. The NVD record notes that this could lead to unauthorized information disclosure or data modification. The flaw is not present in all endpoints, but only in those where the specific annotation usage triggers the silent drop of security constraints.
Why it matters
The NVD record describes the flaw as allowing unauthenticated attackers to bypass security controls on generated endpoints. This means that endpoints which should be protected by class-level security requirements may become accessible without authentication. The potential impact includes unauthorized information disclosure or data modification, as stated in the source material.
The severity of CVSS 9.1 reflects the critical nature of the vulnerability. The flaw allows for permissive, unauthenticated access to affected endpoints. This is a significant risk for organisations using Quarkus REST Data Panache, as it undermines the security controls intended to protect sensitive data. The issue arises from the code generator’s handling of the @MethodProperties annotation.
For organisations using Red Hat’s build of Quarkus, the NVD record lists this product as affected. The flaw does not require complex exploit chains, but rather relies on the developer’s failure to re-declare security roles. This makes it a structural issue in how the code generator interprets and applies security annotations. The risk is present in any endpoint where the specific annotation usage triggers the silent drop of security constraints.
What happens next
- Review Quarkus REST Data Panache endpoints for usage of @MethodProperties annotations.
- Verify that security roles are explicitly re-declared in any customised operations.
- Check for class-level security requirements that may have been silently dropped.
- Monitor Red Hat advisories for updates on the affected builds of Quarkus.
What to do and how to stay safe: Quarkus
- Audit your Quarkus REST Data Panache codebases for any endpoints using @MethodProperties without explicit security role re-declaration.
- Implement automated code analysis rules to flag instances where class-level security constraints might be bypassed by custom annotations.
- Ensure that all critical endpoints have explicit, method-level security annotations to prevent reliance on class-level defaults.
- Wait for the vendor to provide an update or patch for the affected versions of Quarkus before applying any unofficial fixes.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritise Fixes That Matter
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-87744?
CVE-2026-87744 is a critical vulnerability in Quarkus REST Data Panache that allows unauthenticated attackers to bypass security controls on generated endpoints.
Which products are affected by this flaw?
Red Hat Exploit Intelligence and Red Hat’s build of Quarkus are listed as affected products in the National Vulnerability Database record.
How can developers prevent this issue in their code?
Developers should explicitly re-declare security roles when using @MethodProperties to customise operations, ensuring class-level security requirements are not dropped.
