CVE-2026-87744

Executive Summary

CVE-2026-87744 is an authorization-bypass flaw (CWE-425, "Direct Request / Forced Browsing") in the Quarkus REST Data Panache code generator. When a developer customizes an operation with @MethodProperties but does not re-declare security roles on that operation, the generator silently discards the class-level security requirements, causing the affected generated REST endpoint to be exposed without authentication. Unauthenticated, network-reachable attackers can therefore reach endpoints that were intended to be protected, resulting in unauthorized information disclosure or modification of the underlying data (CVSS 9.1). No patch, no public PoC, and no known exploitation in the wild were identified at the time of writing.

Technical Analysis

Quarkus REST Data Panache is a code-generation layer that derives JAX-RS/REST endpoints from repository interfaces, allowing developers to expose CRUD-style operations without hand-writing controller code. Security constraints in this model are typically applied declaratively — for example via class-level security annotations that the generator propagates to each generated endpoint's metadata.

The defect described in the NVD record is a security-metadata propagation failure in the generator: when a developer overrides or customizes a specific operation using @MethodProperties and does not explicitly re-declare the required roles on that operation, the generator "silently drops class-level security requirements." The generated endpoint therefore defaults to permissive, unauthenticated access. Because the endpoint remains a valid, generated, publicly routed REST resource, requests reach the data-access layer without ever passing an authentication/authorization decision.

Key characteristics of this vulnerability class:

• It is a logic/configuration defect in generated security metadata rather than a memory-safety or injection bug.
• The failure is silent: no error, no startup warning, and no runtime denial — the endpoint simply behaves as if it were public.
• Impact is bounded by which operations were customized with @MethodProperties and which repositories were exposed; the flaw affects only those affected endpoints, not the entire application.
• Exploitation requires the endpoint to be network-reachable, which is the normal deployment posture for public-facing Quarkus REST services.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N reflects that no privileges or user interaction are needed, complexity is low, and the confidentiality and integrity impacts are high, while availability is unaffected (A:N). CWE-425 (Direct Request, a.k.a. Forced Browsing) is the correct classification: the attacker directly requests a resource that should not be reachable without authorization, and the access-control enforcement is absent rather than bypassable through obfuscation.

No affected version range, no affected artifact coordinates, and no fix commit were supplied by any tracked source. Any statement about specific release versions would be speculation and is deliberately omitted.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available; the following attack chain is inferred strictly from the vulnerability class (missing/forced-browsing authorization) and the NVD description. No specific function names, URL paths, or parameter names beyond those in the description (@MethodProperties) are asserted.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-reachable Quarkus application that exposes REST Data Panache-generated endpoints. This can be done through application fingerprinting (Quarkus-specific response headers, error pages, health/metrics endpoints if exposed), by enumerating the generated REST resource paths derived from repository names, or by harvesting the API surface from client-side code, OpenAPI descriptions, or documentation left accessible in production.

2. Triggering the flaw class. For each candidate generated endpoint, the attacker issues direct unauthenticated requests (e.g., HTTP GET for read operations and, per the NVD description, requests capable of modification for write operations) without any session cookie, bearer token, or other credential. Because the generator dropped the class-level security requirement for operations annotated with @MethodProperties when roles were not re-declared, the security layer does not challenge the request — there is no 401/403 to defeat, no token to forge, and no parameter to tamper with. The absence of enforcement is the entire exploit primitive.

3. Payload / execution method. The "payload" is simply a well-formed request to a protected-by-intent endpoint. At the vulnerability-class level, this is forced browsing: the attacker enumerates and directly accesses resources whose authorization metadata was stripped during code generation. Because the flaw is triggered by the application's own configuration/generation behavior rather than by attacker-supplied input, no injection payload, encoding trick, or memory-corruption primitive is required.

4. Post-exploitation impact. Successful requests execute the underlying repository operation with the application's own data-access privileges. Read operations yield unauthorized information disclosure (records the endpoint was meant to restrict); write/update/delete operations yield unauthorized data modification or destruction. The CVSS high Confidentiality and Integrity scores are consistent with both outcomes. Availability is not directly impacted per the vector.

At the time of writing, there is no evidence of exploitation in the wild, no CISA KEV listing, and no public PoC; real-world exploitation would require an attacker to have already identified a Quarkus deployment that uses REST Data Panache with @MethodProperties customizations lacking re-declared roles.

Impact Assessment

• Business impact: Exposure of business-critical data (customer records, internal records, financial or operational data) to unauthenticated parties, plus the ability to alter or delete that data. Because the access is unauthenticated, there is no audit trail linking actions to an authenticated principal, complicating attribution and forensic reconstruction.
• Affected systems: Quarkus applications that expose REST Data Panache-generated endpoints and that customize operations via @MethodProperties without re-declaring security roles. Applications that never customized operations this way, or that re-declared roles, are unaffected.
• Blast radius: Scoped to the specific customized endpoints, but those endpoints are often the most sensitive read/write operations in the generated API. In multi-tenant or shared deployments, one exposed write endpoint can corrupt data used by many downstream consumers.
• CVSS subscores: Confidentiality High (C:H) and Integrity High (I:H) confirm serious data-exposure and data-tampering risk; Availability None (A:N) means the flaw does not itself cause service degradation. Low attack complexity and no privileges/user interaction required (AC:L, PR:N, UI:N) mean exploitation, once the endpoint is known, is trivial to automate at scale.
• Exploitability context: CVSS 9.1 is near-critical. No EPSS score has been published by FIRST.org, and there is no KEV entry — meaning current prioritization must rely on environmental exposure (is a vulnerable Quarkus API reachable?) rather than on observed exploitation.

Detection Guidance

Detection must target the behavior of unauthenticated access to endpoints that normally require a principal. Because generated endpoints may not emit distinctive payloads, detections focus on access-log/authorization anomalies and on the generator/config changes that produce the exposure.

Sigma Rule

title: Unauthenticated Access to Quarkus REST Data Panache Endpoint (CVE-2026-87744)
id: 7f2c1a94-3b6e-4d2a-9c11-8a5e0d2f6b71
status: experimental
description: Detects successful HTTP requests to Quarkus REST Data Panache-generated endpoints that arrive without any authentication context, consistent with CVE-2026-87744 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87744
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/api/'
      - '/rest/'
  selection_unauth:
    - sc-status: 200
    - cs-uri-query|contains: 'role='
  filter_authenticated:
    cs-username: '*'
    cs-authorization: '*'
  condition: selection_path and selection_unauth and not filter_authenticated
falsepositives:
  - Publicly intended anonymous API endpoints
  - Health, metrics, or documentation endpoints excluded from scope
level: high

YARA Rule

rule CVE_2026_87744_Quarkus_REST_Data_Panache_Authz_Bypass
{
    meta:
        author      = "valtersit.com"
        description = "Detects Quarkus REST Data Panache source/config referencing @MethodProperties without re-declared security roles (CVE-2026-87744)"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-87744"
        date        = "2026-01-01"
        severity    = "high"

    strings:
        $quarkus   = "io.quarkus" ascii wide nocase
        $panache   = "rest-data-panache" ascii wide nocase
        $method    = "@MethodProperties" ascii wide
        $sec1      = "@RolesAllowed" ascii wide
        $sec2      = "@Authenticated" ascii wide
        $sec3      = "@DenyAll" ascii wide

    condition:
        $quarkus and $panache and $method and not any of ($sec*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87744 Quarkus REST Data Panache unauthenticated access to generated endpoint"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/"; nocase; http.header; content:"Authorization"; negated; http.header; content:"Cookie"; negated; classtype:attempted-recon; reference:cve,2026-87744; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87744; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:2026877441; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method in ("GET", "POST", "PUT", "PATCH", "DELETE")
      and url.path like "/api/*"
      and not exists(http.request.headers.authorization)
      and not exists(http.request.headers.cookie) ]
  [ network where http.response.status_code in (200, 201, 204)
      and url.path like "/api/*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=lower(uri)
| where (like(uri, "%/api/%") OR like(uri, "%/rest/%"))
| where isnull(cookie) AND isnull(authorization)
| where status IN (200, 201, 204)
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as endpoints by clientip, host
| where count > 5
| sort - count
| table first_seen last_seen clientip host count endpoints

Wazuh OSSEC Rule

<group name="web,quarkus,cve-2026-87744,">
  <rule id="2026877" level="10">
    <if_sid>31100</if_sid>
    <match>rest-data-panache|/api/|/rest/</match>
    <regex>GET|POST|PUT|PATCH|DELETE</regex>
    <description>CVE-2026-87744: Possible unauthenticated access to Quarkus REST Data Panache generated endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87744,authorization_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, no affected-version table, and no workaround were provided. The following actions are defensive measures derived from the vulnerability class and the mechanism described in the NVD record.

1. Immediate mitigations

• Inventory Quarkus REST Data Panache usage. Identify every repository interface that exposes generated REST endpoints and every operation customized via @MethodProperties.
• Add explicit, per-operation security declarations. For each customized operation, re-declare the intended security roles/constraints directly on that operation rather than relying on class-level propagation.
• Reduce exposure. Where the endpoint is not required to be public, restrict it at the network edge with an authenticated reverse proxy, API gateway policy, mTLS, or IP allow-listing, so that an unauthenticated request never reaches an endpoint that silently lost its security metadata.
• Validate at build time. Add CI checks that fail the build if any generated REST Data Panache endpoint lacks an authentication/authorization annotation, and review generated OpenAPI/route definitions to confirm each endpoint's intended security posture.

2. Patch / upgrade steps

• No patch is currently available from any tracked source. Obtain an authoritative fix only from the Quarkus project's official advisory and release channels; do not apply third-party, unsigned, or vendor-unverified patches.
• Until a fix ships, treat the explicit-declaration mitigation above as mandatory rather than optional.
• Monitor the Quarkus security advisories page and the NVD entry for CVE-2026-87744 for version ranges and fixed releases.

3. Long-term hardening

• Adopt a fail-closed authorization model: default-deny on generated endpoints, with authentication required unless explicitly exempted in review.
• Enforce defense in depth so that loss of framework-level security metadata does not equal loss of access control (gateway auth, service mesh authorization policies, network segmentation).
• Include authorization-bypass regression tests that assert 401/403 for unauthenticated requests against every generated endpoint in the test suite.
• Continuously monitor access logs for unauthenticated 2xx responses on API paths as a standing detection control.

References

• NVD — CVE-2026-87744: https://nvd.nist.gov/vuln/detail/CVE-2026-87744
• CWE-425 — Direct Request ('Forced Browsing'): https://cwe.mitre.org/data/definitions/425.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Quarkus Security Advisories (vendor channel for authoritative fix information): https://quarkus.io/security/
• FIRST.org EPSS (no score currently published for this CVE): https://www.first.org/epss/

Threat actor campaign data: none available. No CISA KEV listing, no public PoC, no exploit code, and no evidence of in-the-wild exploitation were identified in the intelligence provided for CVE-2026-87744.