CVE-2026-94451

MediumCVSS 6.5

Published: 12/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Summary

Quarkus REST Data Panache provides automatic REST endpoints for data entities. Certain endpoints do not validate the sort parameter supplied by users, allowing attackers to access unauthorized information or force the database into complex operations, potentially causing denial of service.

Risk Assessment

Attackers could gain unauthorized access to sensitive data or disrupt service availability by overloading the database.

Recommendation

Update Quarkus to a patched version immediately and restrict user control over sort parameters, e.g., by validating against an allowlist.

Other vulnerabilities in Quarkus REST Data Panache

CVE-2026-87744Critical
A flaw was found in Quarkus REST Data Panache that allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. As a result, the affected endpoint defaults to permissive, unauthenticated access.

Original NVD description (English source)

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS