CVE-2026-107912: Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.
Other sources
An authorization bypass vulnerability was identified in the Quarkus management interface. The flaw exists in the path matching logic within the quarkus-vertx-http component. By default, the management root is set to /q without a trailing slash. When a security policy is defined for a relative path (such as secret), the internal path matcher concatenates these directly as /qsecret instead of /q/secret.
Consequently, the security policy protects the non-existent path /qsecret, while the actual management endpoint at /q/secret remains completely unprotected. A local attacker, or an attacker with access to the private management network, can exploit this flaw to access protected management endpoints without authentication or with low privileges. Successful exploitation allows the attacker to view sensitive internal information and modify management configurations.
— Red Hat