Auth bypass in Red Hat Exploit Intelligence
CVE-2026-107912
A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-107912 (vdb-entry)
- RHBZ#2548364 (issue-tracking)
Frequently asked questions
- What is CVE-2026-107912?
- CVE-2026-107912 is a high-severity vulnerability in Red Hat Exploit Intelligence, classified under Missing Authorization. CVSS score: 7.7/10. Published 2026-11-05.
- How severe is CVE-2026-107912?
- High severity. CVSS v3 base score is 7.7 out of 10.