CVE-2026-42333: Quarkus OpenAPI Auth Bypass Vulnerability

CVE-2026-42333 Overview

CVE-2026-42333 affects the Quarkus OpenAPI Generator, a Quarkus extension that generates REST clients and server stubs from OpenAPI specifications. The generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security scheme configured for one operation can be applied to a different same-method operation whose path only partially resembles the protected template. This causes bearer tokens, API keys, or basic credentials to be transmitted to unintended endpoints. The flaw is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Maintainers have patched the issue in versions 2.11.1-lts, 2.16.0-lts, and 2.17.0.

Critical Impact

Authentication credentials including bearer tokens, API keys, and basic credentials may be sent to unintended REST endpoints, enabling credential leakage to third-party services.

Affected Products

• Quarkus OpenAPI Generator versions prior to 2.11.1-lts
• Quarkus OpenAPI Generator versions prior to 2.16.0-lts
• Quarkus OpenAPI Generator versions prior to 2.17.0

Discovery Timeline

• 2026-05-09 - CVE-2026-42333 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42333

Vulnerability Analysis

The Quarkus OpenAPI Generator produces REST client code from OpenAPI specifications, including authentication filters that attach configured credentials to outgoing requests. The generated filter logic determines which security scheme applies to a given request by matching the request path against OpenAPI path templates. The matching algorithm performs substring or prefix-style comparisons rather than strict template equivalence. As a result, the filter associates credentials with operations whose paths only partially resemble the originally protected template.

When multiple operations share the same HTTP method and have structurally similar paths, the filter cannot reliably distinguish between them. Credentials intended for a single protected operation are attached to other operations that should not receive them. The exposure surface depends on the API definition and the third-party endpoints invoked by the generated client.

Root Cause

The root cause is improper template matching logic in the generated authentication filter. The matcher treats OpenAPI path templates as loose patterns instead of distinct identifiers tied to specific operations. The filter does not bind each security scheme strictly to its declared operation, causing credentials to bleed across operations sharing the same method.

Attack Vector

Exploitation does not require active attacker interaction. Any application built with a vulnerable version of the generator and an OpenAPI specification containing same-method operations with overlapping path structures may transmit credentials to unintended endpoints. A malicious or compromised third-party API endpoint reachable through the generated client would receive credentials intended for a different protected operation. The vulnerability is network-reachable but depends on the structure of the OpenAPI specification consumed by the generator.

The technical fix is documented in the Quarkus OpenAPI Generator Pull Request #1586 and the GitHub Security Advisory GHSA-fr8f-rwjx-f32v.

Detection Methods for CVE-2026-42333

Indicators of Compromise

• Outbound HTTP requests from Quarkus applications carrying Authorization headers, API key headers, or basic credentials to endpoints not declared as protected in the source OpenAPI specification.
• Generated client classes from quarkus-openapi-generator referencing an AuthenticationFilter or AuthenticationPropagationFilter with version metadata prior to 2.11.1-lts, 2.16.0-lts, or 2.17.0.
• Unexpected 401 or 403 responses from external services receiving credentials that do not belong to them.

Detection Strategies

• Inventory all Quarkus projects and identify the version of io.quarkiverse.openapi.generator:quarkus-openapi-generator declared in pom.xml or build.gradle.
• Audit OpenAPI specifications consumed by the generator for operations sharing the same HTTP method and structurally similar paths, where only some are protected by a security scheme.
• Inspect outbound traffic from generated REST clients and verify that credentials are only attached to operations explicitly declared as secured.

Monitoring Recommendations

• Capture egress traffic from Quarkus services and alert on Authorization headers sent to hostnames or paths outside the documented secured set.
• Track build-time dependency reports for quarkus-openapi-generator versions and fail builds that resolve to vulnerable releases.
• Forward application logs and outbound HTTP telemetry to a centralized data lake for correlation against the published advisory.

How to Mitigate CVE-2026-42333

Immediate Actions Required

• Upgrade quarkus-openapi-generator to 2.11.1-lts, 2.16.0-lts, or 2.17.0 depending on the supported branch.
• Rotate any bearer tokens, API keys, and basic credentials that may have been transmitted by generated clients prior to patching.
• Regenerate all REST clients and server stubs from OpenAPI specifications after upgrading the generator.
• Review OpenAPI specifications for operations with overlapping path structures and confirm each security scheme is bound to the intended operation.

Patch Information

Maintainers released fixes in Quarkus OpenAPI Generator 2.11.1-lts, Quarkus OpenAPI Generator 2.16.0-lts, and Quarkus OpenAPI Generator 2.17.0. The corresponding code change is in Pull Request #1586, and the advisory is published as GHSA-fr8f-rwjx-f32v.

Workarounds

• Restrict outbound network access from Quarkus applications to only the explicit set of hostnames and paths required by the secured operations.
• Manually edit generated authentication filters to enforce strict equality between the request operation and the configured security scheme until the upgrade is applied.
• Split OpenAPI specifications so that secured operations do not share HTTP methods with structurally similar unsecured operations.

# Update the dependency version in Maven pom.xml
mvn versions:set-property \
  -Dproperty=quarkus-openapi-generator.version \
  -DnewVersion=2.17.0

# Regenerate clients and rebuild
mvn clean package