CVE-2026-94451

Executive Summary

CVE-2026-94451 is an input-validation flaw (CWE-20) in Quarkus REST Data Panache, a Quarkus extension that automatically generates REST endpoints for data entities. Certain generated endpoints do not properly validate the user-supplied sort parameter, allowing an unauthenticated, remote attacker to influence how the backing database executes queries. Successful abuse can expose data the attacker is not authorized to access (low confidentiality impact) and can force the database to perform expensive operations, degrading availability and potentially causing a denial of service. No patch, public proof-of-concept, or exploit code is currently available, and no affected-version range has been published, so exposure assessment must be performed by inventorying REST Data Panache usage directly.

Technical Analysis

REST Data Panache is a Quarkus extension that exposes JPA/Panache entities through automatically generated REST resources. Because the endpoints are generated rather than hand-written, query-shaping inputs such as pagination and sorting are accepted directly from the HTTP request and translated into database query semantics. The NVD description states that "certain endpoints do not properly check the sort parameter provided by users" — that is, the sort parameter is not validated or allow-listed before it is applied to the underlying query.

The root cause is CWE-20, Improper Input Validation. The vulnerability class is best understood as sort-parameter injection into the generated query layer. Where a properly hardened implementation would restrict sort input to a fixed set of known, entity-permitted fields, the affected endpoints accept arbitrary user-supplied sort input and pass it into the query path. Two distinct consequences follow from the same missing check:

1. Information disclosure (C:L). By manipulating the sort parameter, an attacker can cause the query to be ordered — and therefore inferable — by properties that were never intended to be exposed or usable as a sort key. Ordering by a non-exposed or access-controlled field allows the attacker to deduce that field's values through response ordering, an oracle-style inference channel that does not require direct read access to the field. This is a classic ordinal/ordering side channel: the attacker learns data they "should not have access to" without ever receiving the field in the response body.

2. Denial of service (A:L). By supplying sort input that references expensive or unindexed columns, or that forces the database to perform costly work (the description explicitly notes "forcing the database to perform complex tasks"), the attacker can drive resource-intensive query execution. Repeated requests amplify the load, degrading the availability of the application and its database.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L reflects the assessment accurately: the attack is network-reachable, requires low complexity, needs no privileges and no user interaction, does not cross a security scope boundary, and yields low confidentiality and low availability impact with no integrity impact. The integrity subscore is None because the flaw corrupts neither stored data nor application state — it shapes how queries are executed, not what is written.

Critically, the description does not name specific endpoint paths, parameter formats, entity classes, or generated method names, and no affected version range, patch, or advisory has been published. Analysts should therefore treat the mechanics above as the vulnerability-class behavior for unvalidated sort input in generated REST query endpoints, and confirm concrete exploitability against their own deployment by inspecting which REST Data Panache endpoints are internet-reachable. No technical detail beyond the description is asserted here.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code exists for CVE-2026-94451. The attack chain below is inferred strictly from the vulnerability class (improper validation of a user-supplied sort parameter in auto-generated REST endpoints) and the NVD description; no specific implementation details are fabricated.

1) Reconnaissance / target identification. An unauthenticated attacker identifies internet-facing Quarkus applications that expose automatically generated REST Data Panache endpoints. This is passive, low-noise enumeration: fingerprinting the application stack and then probing the generated collection endpoints for sort-accepting query behavior. Because REST Data Panache endpoints are generated for data entities, the attacker's goal at this stage is simply to locate endpoints that accept a user-controllable sort parameter and return ordered result sets.

2) Triggering the flaw class. The attacker issues requests to a discovered endpoint and supplies arbitrary input in the sort parameter. The endpoint, per the description, "does not properly check the sort parameter," so the supplied value is accepted rather than rejected or constrained to an allow-list of sortable fields. No authentication is required (PR:N) and no user interaction is needed (UI:N).

3) Payload / execution at the vulnerability-class level. Two abuse patterns follow directly from the description:

• Inference via ordering: the attacker supplies sort values that reference fields not intended for exposure or use as sort keys, then reads the ordering of the returned results to infer values of those fields. This is an information-disclosure oracle — the attacker learns information they should not have access to without the field necessarily appearing in the response.
• Resource exhaustion via expensive sorting: the attacker supplies sort values that cause the database to perform complex work (for example, forcing expensive comparisons or non-indexed orderings), then repeats the request to drive sustained load. This is the denial-of-service vector described in the advisory.

No injection syntax, endpoint path, or parameter encoding is asserted here because the source data does not describe any.

4) Post-exploitation impact. Confidentiality impact is bounded to low: the attacker gains ordering-based inference over data rather than bulk data exfiltration, and there is no evidence of code execution, authentication bypass, or data modification (integrity subscore is None). Availability impact is bounded to low per CVSS, but repeated expensive-query requests against a shared or under-provisioned database can compound into a practical denial of service for legitimate users.

Impact Assessment

The impacted component is the Quarkus REST Data Panache extension wherever it is used to auto-generate REST endpoints over data entities. The blast radius is any deployment that (a) uses REST Data Panache, (b) exposes the generated endpoints to untrusted networks (including the public internet), and (c) accepts unauthenticated requests to those endpoints. Because affected-version data is absent, every deployment of the extension must be treated as potentially affected until the environment is inspected or a vendor advisory establishes scope.

Business impact:

• Confidentiality (C:L). Ordering-based inference can leak the existence and relative values of fields that should not be accessible to the caller. This is a slow, low-volume leak, but it can expose sensitive business or user attributes if the affected entity backs an access-controlled record set.
• Availability (A:L). Attacker-induced expensive sorting can degrade application and database responsiveness. In environments where the database is a shared bottleneck, even "low" per-request impact can scale into material service disruption under repetition.
• Integrity (I:N). None — the flaw does not permit data modification.
• Scope (S:U). Unchanged — impact remains within the application/database boundary.

Because no CISA KEV entry exists and no exploit code or PoC is available, there is no evidence of active exploitation in the wild. Risk should be scored on exposure and asset criticality: an internet-facing, unauthenticated REST Data Panache endpoint bound to a sensitive entity is materially higher risk than an internal-only deployment. The CVSS base score is 6.5 (Medium), and no EPSS score has been published by FIRST.org at the time of writing.

Detection Guidance

The rules below target the vulnerability class — abnormal sort-parameter manipulation against generated REST endpoints — and should be tuned to the environment's actual endpoint inventory and query logging.

Sigma Rule

title: Quarkus REST Data Panache Sort Parameter Manipulation Attempt
id: 3f4b9c21-7d0a-4e8b-9c1a-6b2f5e8a0d34
status: experimental
description: Detects HTTP requests whose sort parameter contains unexpected or suspicious values against Quarkus REST Data Panache generated endpoints, consistent with CVE-2026-94451 sort-parameter abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94451
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-query|contains: 'sort='
  selection_suspicious:
    cs-uri-query|contains:
      - 'sort=*password*'
      - 'sort=*token*'
      - 'sort=*secret*'
      - 'sort=*ssn*'
      - 'sort=*%20'
      - 'sort=*-'
      - 'sort=*+'
  selection_repeat:
    cs-uri-query|contains: 'sort='
  condition: selection_endpoint and selection_suspicious
falsepositives:
  - Legitimate clients sorting by documented, exposed fields
  - Applications that legitimately allow sorting by all entity fields
level: medium
tags:
  - attack.t1190
  - cve.2026.94451

YARA Rule

rule CVE_2026_94451_RESTDataPanache_SortAbuse
{
    meta:
        description = "Detects HTTP requests abusing unvalidated sort parameter against Quarkus REST Data Panache endpoints (CVE-2026-94451)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94451"
        cve = "CVE-2026-94451"

    strings:
        $q1 = "sort=" ascii nocase
        $q2 = "&sort=" ascii nocase
        $q3 = "?sort=" ascii nocase
        $s1 = "password" ascii nocase
        $s2 = "secret" ascii nocase
        $s3 = "token" ascii nocase
        $s4 = "%20" ascii
        $s5 = " UNION" ascii nocase

    condition:
        any of ($q*) and any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94451 Quarkus REST Data Panache sort parameter manipulation attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"sort="; nocase; http.uri; pcre:"/sort=[^&]*(password|secret|token|ssn|credit)/i"; reference:cve,2026-94451; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94451; classtype:attempted-recon; sid:202694451; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where network.protocol == "http" and
      url.query contains "sort=" and
      (url.query contains "password" or
       url.query contains "secret" or
       url.query contains "token") ]
  [ network where network.protocol == "http" and
      url.query contains "sort=" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri_query, "(?i)sort=")
| eval suspicious=if(match(uri_query, "(?i)sort=[^&]*(password|secret|token|ssn|credit|admin)"), 1, 0)
| bin _time span=5m
| stats count as sort_requests,
        sum(suspicious) as suspicious_sorts,
        dc(clientip) as client_count
        by _time, host, uri_path, clientip
| where suspicious_sorts > 0 OR sort_requests > 100
| sort - suspicious_sorts
| table _time, host, uri_path, clientip, sort_requests, suspicious_sorts

Wazuh OSSEC Rule

<group name="web,quarkus,cve-2026-94451,">
  <rule id="202694451" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">sort=</field>
    <regex type="pcre2">(?i)sort=[^&]*(password|secret|token|ssn|credit)</regex>
    <description>CVE-2026-94451: Possible Quarkus REST Data Panache sort parameter manipulation (sensitive field in sort)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_94451,</group>
  </rule>

  <rule id="202694452" level="5" frequency="50" timeframe="300">
    <if_matched_sid>202694451</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-94451: High-volume sort parameter manipulation from single source (possible DoS attempt)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_94451,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, no workaround, and no affected-version data have been published. The following guidance is therefore engineering-level risk reduction, not a validated vendor remediation.

1) Immediate mitigations

• Restrict exposure. Remove internet reachability from REST Data Panache generated endpoints that are not strictly required to be public. Place them behind an authenticated reverse proxy or API gateway; the CVSS vector shows the attack requires no privileges (PR:N), so adding an authentication boundary directly raises attacker cost.
• Constrain the sort parameter at the edge. Where a WAF or reverse proxy sits in front of the application, reject requests whose sort parameter references fields outside a documented allow-list, or that contain unexpected characters or non-field-name tokens. This compensates for the missing in-application validation but does not replace it.
• Rate-limit and throttle. Apply per-client rate limits to endpoints that accept sort input to blunt the expensive-query/DoS vector while a durable fix is developed.
• Reduce database blast radius. Ensure the database user backing the affected endpoints has least privilege and that the database enforces resource governance (statement timeouts, query cost ceilings, connection limits) so that a single expensive sort cannot degrade the whole instance.

2) Patch/upgrade steps

• Monitor the Quarkus project's security advisories, release notes, and the NVD entry for CVE-2026-94451 for a fixed version. No fixed version is available today; do not assume upgrading to the latest Quarkus release resolves this issue until a vendor advisory confirms it.
• When a fix or advisory lands, determine the first fixed release from the vendor, pin Quarkus and the REST Data Panache extension to that version, and re-test the generated endpoints after upgrade.
• Inventory every service using REST Data Panache now, so that remediation can be applied the moment a version range or patch is published.

3) Long-term hardening

• Treat generated endpoints as untrusted input surfaces. Because REST Data Panache generates endpoints automatically, query-shaping inputs such as sort and pagination receive less developer scrutiny than hand-written code. Adopt a standing review for all auto-generated endpoints.
• Enforce sort allow-listing in code. Where the extension offers configuration or extension points to restrict sortable fields, apply them per entity so that only intended, exposed fields can be used as sort keys.
• Architectural defense in depth. Authenticate and authorize generated data endpoints by default; do not rely on obscurity of the endpoint path.
• Monitoring. Deploy the detection content above and tune it to the environment's real endpoint inventory and query logs, alerting on abnormal sort parameters and on request-rate spikes against sort-accepting endpoints.

References

1. NVD — CVE-2026-94451: https://nvd.nist.gov/vuln/detail/CVE-2026-94451
2. Quarkus REST Data Panache documentation (project extension reference): https://quarkus.io/guides/rest-data-panache
3. CWE-20: Improper Input Validation — MITRE: https://cwe.mitre.org/data/definitions/20.html
4. FIRST.org EPSS — no score published for CVE-2026-94451 at time of writing: https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-94451 not listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns: none identified. There is no CISA KEV entry, no public PoC, no Nuclei template, and no exploit code associated with CVE-2026-94451 at the time of writing, and no evidence of exploitation in the wild. Treat the absence of public exploitation as an opportunity to remediate before weaponization, not as a reason to deprioritize internet-facing REST Data Panache deployments.