External risk intelligence

Quarkus REST Data Panache Security Bypass Flaw Allows Unauthenticated Access

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-87744

This vulnerability affects Quarkus REST Data Panache, which is used to build web APIs. Because these generated endpoints are designed to be network-accessible to interact with data, and the flaw results in these endpoints becoming unauthenticated by default, they are commonly deployed in internet-facing or externally reachable API configurations.

Information Disclosure

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw has been identified in Quarkus REST Data Panache, a technology used for developing web APIs. This issue could allow unauthorized access to generated endpoints by bypassing security settings, potentially exposing or allowing modification of data. The primary concern is to confirm if your systems utilize this technology and are potentially exposed.

Flaw bypasses security on generated API endpoints.
Leadership should track for potential unauthorized access.
Confirm if Quarkus REST Data Panache is in use.

Attack Path

How an attacker could exploit the issue

An attacker can reach and trigger this vulnerability by interacting with a Quarkus REST Data Panache generated endpoint over the network. If a developer has customized a specific operation using `@MethodProperties` without re-declaring security roles, the vulnerability allows unauthenticated access to that endpoint. This exposure can lead to unauthorized access to sensitive information or data manipulation.

Network access required
Customized endpoint trigger
Unauthorized data access risk

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Quarkus REST Data Panache could allow unauthenticated attackers to bypass security measures on generated API endpoints. When developers customize operations without re-declaring security roles, class-level security requirements may be dropped, resulting in permissive, unauthenticated access to endpoints. This could lead to unauthorized access to and modification of sensitive information.

Generated API endpoints.
Unauthenticated bypass of security controls.
Unauthorized data access and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world remediation for this flaw in Quarkus REST Data Panache likely involves application development teams responsible for the code and platform teams managing the underlying infrastructure. The first practical step is to identify all instances of Quarkus REST Data Panache, determine if the affected endpoints are exposed externally or are critical, and identify the accountable application owner. Subsequent planning should prioritize remediation based on the assessed risk.

Application owners must verify configurations.
Confirm endpoint exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Quarkus REST Data Panache?

It is a development framework extension used to create web APIs quickly by automatically generating CRUD (create, read, update, delete) endpoints. Developers use it to map data entities to network-accessible services, simplifying the back-end infrastructure required to manage application data.

How does CVE-2026-87744 bypass security?

This flaw belongs to the CWE-425 class, known as Forced Browsing or Direct Request. The vulnerability occurs because the framework's code generator fails to enforce class-level security roles when a developer uses @MethodProperties to modify an operation. The system incorrectly defaults to a permissive, unauthenticated state for those specific endpoints, ignoring the intended access restrictions.

What triggers this vulnerability?

An attacker triggers this by sending network requests to the affected API endpoints. It is important to note that the vulnerability does not trigger unless a developer has customized an operation using @MethodProperties without explicitly re-declaring the necessary security roles. If those specific customizations are absent, the security bypass does not occur.

Is my system at risk according to Halo Surface Signal?

Because this flaw affects web APIs intended for data interaction, Halo Surface Signal flags it as likely to be relevant. These generated endpoints are frequently deployed in internet-facing configurations to be accessible by clients, which increases the likelihood that an unauthorized user can reach the vulnerable service over the network.

How should I respond to this threat?

Your first step is to perform an inventory of your applications to identify which ones use the Quarkus REST Data Panache extension. Once identified, work with your development teams to audit instances where @MethodProperties is used, ensuring that security roles are explicitly defined and enforced for every customized endpoint operation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.