CVE-2026-87744: Quarkus REST Data Panache Auth Bypass

CVE-2026-87744 Overview

A security flaw in Quarkus REST Data Panache allows unauthenticated attackers to bypass access controls on generated REST endpoints. The code generator silently drops class-level security requirements when a developer customizes an operation using @MethodProperties without re-declaring the security roles. The affected endpoint then defaults to permissive, unauthenticated access. Attackers can reach these endpoints over the network without credentials or user interaction, enabling unauthorized data disclosure and modification. The weakness is tracked under [CWE-425] Direct Request (Forced Browsing).

Critical Impact

Unauthenticated network attackers can read or modify data exposed by generated Panache endpoints when security roles are not explicitly re-declared on customized operations.

Affected Products

• Quarkus REST Data Panache
• Red Hat build of Quarkus (see Red Hat advisories RHSA-2026:83082 and RHSA-2026:83520)
• Applications generating REST endpoints via Panache with @MethodProperties customization

Discovery Timeline

• 2026-10-12 - CVE-2026-87744 published to the National Vulnerability Database
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-87744

Vulnerability Analysis

Quarkus REST Data Panache generates REST endpoints automatically from Panache repository or entity classes. Developers can annotate those classes with security constraints such as @RolesAllowed to require authentication and authorization. When a developer customizes an individual operation using the @MethodProperties annotation, the code generator fails to carry over class-level security requirements onto the customized method. The generated endpoint is emitted without an authentication or role check. The result is a silent downgrade from protected to open access, which breaks the trust assumption that class-level annotations apply to every generated operation.

Root Cause

The root cause is an inheritance gap in the endpoint generation logic. The generator treats @MethodProperties as a full override of the operation's metadata rather than as a partial customization. Security attributes declared at the class level are not merged into the generated method descriptor. Any operation touched by @MethodProperties ships without the parent class's authorization requirements unless the developer repeats them explicitly.

Attack Vector

Exploitation requires only network access to the exposed endpoint. An attacker enumerates generated REST paths, such as list, get-by-id, create, update, or delete operations on a Panache resource. Requests sent to a customized operation succeed without credentials, returning or modifying data that the application intended to restrict. No social engineering, prior authentication, or chained vulnerability is required. See the Red Hat Security Information for CVE-2026-87744 for additional technical detail.

No verified public proof-of-concept code is available at the time of writing. Refer to the vendor advisory for exploitation specifics.

Detection Methods for CVE-2026-87744

Indicators of Compromise

• Successful HTTP 200 responses on generated Panache endpoints from clients without Authorization headers or valid session cookies.
• Unexpected data modification events (POST, PUT, PATCH, DELETE) on resources that should require authenticated roles.
• Access log entries showing enumeration patterns across generated REST paths from a single source IP.

Detection Strategies

• Review generated OpenAPI specifications for endpoints that lack security requirements where the parent repository class declares @RolesAllowed.
• Perform authenticated and unauthenticated differential testing against every generated endpoint to identify silent authorization gaps.
• Audit application source for any @MethodProperties usage and confirm that security annotations are repeated on the customized method.

Monitoring Recommendations

• Forward application access logs and WAF telemetry to a centralized analytics tier and alert on anonymous access to business-sensitive REST paths.
• Track baseline request volumes per endpoint and alert on anomalous spikes targeting Panache-generated routes.
• Monitor for failed-then-successful authentication patterns that may indicate credential bypass attempts against the same resource.

How to Mitigate CVE-2026-87744

Immediate Actions Required

• Inventory all Quarkus applications that depend on quarkus-rest-data-panache and identify every use of @MethodProperties.
• Explicitly declare @RolesAllowed or equivalent security annotations on each customized method until patched versions are deployed.
• Place affected services behind an authenticated gateway or reverse proxy that enforces authorization independently of the application layer.

Patch Information

Red Hat has issued fixes through RHSA-2026:83082 and RHSA-2026:83520. Upstream Quarkus consumers should upgrade to the patched release noted in the Red Hat Security Information for CVE-2026-87744. Additional context is available in Red Hat Bugzilla #2530524.

Workarounds

• Re-declare class-level security annotations on every method that uses @MethodProperties to force the generator to emit authorization checks.
• Remove @MethodProperties customizations where feasible and rely on default generation that preserves class-level security.
• Enforce authentication at an upstream API gateway for all Panache-generated routes until the application is upgraded.

# Configuration example
# Explicitly re-declare roles on customized operations
# in your PanacheRepositoryResource until patched versions are deployed
#
# @ResourceProperties(path = "/items")
# @RolesAllowed("admin")
# public interface ItemResource extends PanacheRepositoryResource<ItemRepository, Item, Long> {
#
#     @MethodProperties(path = "custom")
#     @RolesAllowed("admin")   // required: re-declare to prevent silent drop
#     Item get(Long id);
# }