CVE-2026-87744: Red Hat Exploit Intelligence

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.

Affected products

• Red Hat Exploit Intelligence
• Red Hat Red Hat Build Of Quarkus 3.27.6.redhat: before 3.27.6.redhat-00004 (fixed in 3.27.6.redhat-00004)
• Red Hat Red Hat Build Of Quarkus 3.33.4.redhat: before 3.33.4.redhat-00004 (fixed in 3.33.4.redhat-00004)

Published 2026-10-12. Last modified 2026-10-16.