Authorization Bypass in Quarkus Framework's Management Interface

CVE-2026-107912

What is CVE-2026-107912?

A security flaw exists in the management interface of the Quarkus framework, particularly in the quarkus-vertx-http component. This issue arises when the framework mishandles the combination of the management root path with specific permission rules, which can result in the misapplication of security policies across internal paths. Consequently, an attacker may exploit this vulnerability to bypass authorization checks and access sensitive management endpoints that should otherwise be protected.

References