Organisations Face Critical CVE-2026-87744 Risk as Quarkus Panache Drops Role Checks for Unauthenticated Access
A critical vulnerability in Quarkus REST Data Panache allows attackers to bypass security controls by exploiting how the code generator handles method properties.
Key points
- CVE-2026-87744 is rated CVSS 9.1 Critical due to unauthenticated access risks.
- The flaw occurs when @MethodProperties is used without re-declaring security roles.
- Red Hat identifies the issue in its build of Quarkus REST Data Panache.
Organisations using Quarkus REST Data Panache face a critical security risk from a code generation flaw that silently removes security constraints. This vulnerability, tracked as CVE-2026-87744, allows unauthenticated attackers to bypass intended security controls on generated endpoints. The flaw can lead to unauthorized information disclosure or data modification within affected applications.
How does the vulnerability bypass security controls?
The vulnerability arises when developers customise specific operations using the @MethodProperties annotation. If they fail to explicitly re-declare security roles during this customisation, the code generator silently drops class-level security requirements. This behaviour causes the affected endpoint to default to permissive, unauthenticated access, effectively removing the intended access restrictions.
What is the severity and impact of CVE-2026-87744?
The National Vulnerability Database rates CVE-2026-87744 as Critical with a CVSS score of 9.1. The weakness is classified under CWE-425. The primary impact is the potential for unauthenticated users to access endpoints that should be secured, leading to data breaches or unauthorized system changes.
Which products and vendors are affected?
Red Hat has identified this flaw in its Red Hat build of Quarkus. The issue specifically impacts the REST Data Panache component within the framework. Developers using this feature to generate REST endpoints must verify their code configurations, as the default behaviour in certain customisation scenarios compromises security postures without explicit warning.
What should organisations do to mitigate this risk?
Teams should audit their Quarkus applications for any use of @MethodProperties that does not include explicit security role declarations. Verify that class-level security requirements are preserved or re-stated for every customised operation. Monitor for official patches from Red Hat or the Quarkus community, as no confirmed fix has been detailed in the current source material.
What to do and how to stay safe: Quarkus
- Review codebases for instances of @MethodProperties used without explicit security role re-declarations.
- Verify that all generated endpoints maintain their intended class-level security constraints.
- Monitor vendor communications for patches or mitigation guidance regarding CVE-2026-87744.
- Implement strict access controls and monitoring to detect unauthenticated access attempts.
General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-87744?
It is a critical vulnerability in Quarkus REST Data Panache that allows unauthenticated attackers to bypass security controls on generated endpoints.
How does the code generator cause this issue?
When developers use @MethodProperties without re-declaring security roles, the code generator silently drops class-level security requirements, leading to permissive access.
Is there a fix available yet?
No confirmed fix or patch has been stated in the source material; organisations should monitor for updates from Red Hat or the Quarkus project.
