CVE-2026-87743: Red Hat Exploit Intelligence

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

Affected products

• Red Hat Exploit Intelligence
• Red Hat Openshift Serverless
• Red Hat Red Hat Build Of Apache Camel 4 For Quarkus 3
• Red Hat Red Hat Build Of Apicurio Registry 3
• Red Hat Red Hat Build Of Debezium 3
• Red Hat Red Hat Build Of Keycloak
• Red Hat Red Hat Build Of Quarkus 3.27.5.sp2
• Red Hat Red Hat Build Of Quarkus 3.33.3.sp2
• Red Hat Red Hat Fuse 7
• Red Hat Red Hat Openshift Ai Rhoai
• Red Hat Red Hat Openshift Dev Spaces

Published 2026-09-18. Last modified 2026-10-09.