Advisory · CVE-2026-87744
Quarkus REST Data Panache can silently drop endpoint security
Customizing a generated Quarkus REST Data Panache operation with @MethodProperties, without re-declaring security roles, drops the class-level security requirements and leaves the endpoint open to unauthenticated access.
- Vendor
- Red Hat
- Product
- Quarkus REST Data Panache
- Identifier / CWE
- CVE-2026-87744
CWE-425 - Action timing
- Immediate
Explain it like I’m five
A class puts one lock on the building, and each room trusts that lock. Redecorating one room quietly removes its share of the building lock, so that room ends up with no lock at all and anyone can walk in.
- 01Endpoint generated
A developer exposes a repository through Quarkus REST Data Panache, protected by class-level security roles.
- 02Operation customized
The developer customizes one operation using @MethodProperties without explicitly re-declaring the security roles.
- 03Security dropped
The code generator silently drops the class-level security requirements for that operation.
- 04Unauthenticated access
The endpoint defaults to permissive access, so an unauthenticated attacker can read or modify its data.
What happened
Red Hat disclosed CVE-2026-87744 on October 12, 2026, in Quarkus REST Data Panache, and rates it CVSS 3.1 9.1. The flaw is in how generated endpoints handle security annotations.
When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops the class-level security requirements for that operation. The affected endpoint then defaults to permissive, unauthenticated access, which can lead to unauthorized information disclosure or data modification.
The NVD record does not name a fixed Quarkus version, so this advisory does not claim one. Treat the Red Hat advisory as the source for remediation status.
What to do
- Inventory Quarkus services that use REST Data Panache generated endpoints.
- Audit every operation customized with @MethodProperties and confirm its security roles are explicitly declared.
- Apply the remediation in the Red Hat advisory for your Quarkus line as soon as it is available.
- Restrict network access to generated data endpoints until their annotations are verified.
- Review access logs for unauthenticated requests to endpoints that should require a role.
- Add a test that calls each generated endpoint without credentials and expects a rejection.
Management note
This is a silent failure: the code compiles, the endpoint works, and nothing warns that its access control is gone. Any Quarkus team using generated data endpoints should treat an annotation audit as part of patching, not an optional extra.