CVE-2026-89058: Red Hat Build Of Apache Camel 4 For Quarkus 3

High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

Affected products

• Red Hat Red Hat Build Of Apache Camel 4 For Quarkus 3
• Red Hat Red Hat Build Of Apicurio Registry 3
• Red Hat Red Hat Build Of Debezium 3
• Red Hat Red Hat Build Of Keycloak
• Red Hat Red Hat Build Of Quarkus
• Red Hat Red Hat Certificate System 10
• Red Hat Red Hat Certificate System 11
• Red Hat Red Hat Enterprise Linux 10
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 9
• Red Hat Red Hat Fuse 7
• Red Hat Red Hat JBoss Enterprise Application Platform 7
• Red Hat Red Hat JBoss Enterprise Application Platform 8
• Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
• Red Hat Red Hat Satellite 6
• Red Hat Red Hat Single Sign-On 7

Published 2026-09-18. Last modified 2026-10-09.