Quarkus Code Generation Flaw Drops Security Roles on Custom Endpoints

A vulnerability in Quarkus REST Data Panache permits unauthenticated attackers to bypass security controls on generated endpoints. The issue arises when developers customise specific operations using the @MethodProperties annotation without explicitly re-declaring security roles. According to the National Vulnerability Database, this causes the code generator to silently drop class-level security requirements. Consequently, affected endpoints default to permissive access, potentially leading to unauthorised information disclosure or data modification. The flaw is tracked as CVE-2026-87744.

How it unfolded

• The vulnerability was identified in the Quarkus REST Data Panache module.
• Analysis revealed that customising operations with @MethodProperties without re-declaring roles drops security.
• The National Vulnerability Database assigned the flaw a CVSS score of 9.1, classifying it as critical.

Who is affected

Organisations using Red Hat build of Quarkus are affected by this vulnerability. The Red Hat Exploit Intelligence team tracks this issue. Any application developed with Quarkus REST Data Panache that utilises the @MethodProperties annotation for customising operations may be vulnerable if developers do not explicitly re-declare security roles. The weakness is categorised under CWE-425, which relates to insufficient separation of application logic and web server security policy. This means that endpoints intended to be protected may become accessible to anyone on the network.

The fix

No patch or update has been confirmed yet for CVE-2026-87744. Developers should review their codebases for instances where @MethodProperties is used without explicit security role re-declaration. Until a vendor provides an update, teams should monitor for unauthorised access attempts on these endpoints. The National Vulnerability Database record does not list any remediation steps other than the description of the flaw itself. Organisations should prepare to apply fixes once they become available from their respective vendors.

What analysts watch for

Teams usually examine web server logs for unauthenticated requests to endpoints that should require credentials. Analysts check whether access controls have been inadvertently removed from application code during recent deployments. They look for patterns where customised methods lack explicit security annotations, which may indicate silent drops in protection. Monitoring for unusual data access or modification from unauthenticated sources helps identify potential exploitation. Reviewing code generation configurations ensures that security policies are applied consistently across all generated endpoints.

What to do and how to stay safe: Quarkus

• Review application code for uses of @MethodProperties without explicit security role re-declaration.
• Monitor server logs for unauthenticated access attempts to sensitive endpoints.
• Ensure that all generated endpoints maintain required security controls.
• Wait for vendor updates and apply patches as soon as they are released.

Step-by-step guide: Patch Management: Eight Questions Answered for Stability

General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-87744?

It is a critical vulnerability in Quarkus REST Data Panache that allows unauthenticated access to endpoints when security roles are not re-declared with @MethodProperties.

What is the CVSS score for this vulnerability?

The National Vulnerability Database assigns CVE-2026-87744 a CVSS score of 9.1, which is rated as critical.

Which products are affected by this flaw?

Red Hat build of Quarkus is explicitly listed as affected by this vulnerability in the National Vulnerability Database record.