Bug 2548364 (CVE-2026-107912)

Summary: CVE-2026-107912 io.quarkus/quarkus-vertx-http: quarkus-vertx-http: Authorization bypass in management interface via path concatenation flaw
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: ant, aschwart, aszczucz, boliveir, ccranfor, cescoffi, cmah, dhanak, drichtar, drosa, dsimansk, ewittman, fmongiar, gmalinko, gsmet, gtanzill, janstey, jbuscemi, jmartisk, jnethert, jpechane, kaycoth, kingland, manderse, mnovotny, mposolda, nipatil, olubyans, ozzy, pantinor, pdelbell, pjindal, rguimara, rkubis, rmartinc, rstepani, sausingh, sbiarozk, sdawley, security-response-team, ssilvert, sthorger, varjain, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-09 05:05:04 UTC 
An authorization bypass vulnerability was identified in the Quarkus management interface. The flaw exists in the path matching logic within the quarkus-vertx-http component. By default, the management root is set to /q without a trailing slash. When a security policy is defined for a relative path (such as secret), the internal path matcher concatenates these directly as /qsecret instead of /q/secret.

Consequently, the security policy protects the non-existent path /qsecret, while the actual management endpoint at /q/secret remains completely unprotected. A local attacker, or an attacker with access to the private management network, can exploit this flaw to access protected management endpoints without authentication or with low privileges. Successful exploitation allows the attacker to view sensitive internal information and modify management configurations.