Quarkus Code Generator Flaw Exposes Endpoints to Unauthenticated Access

Organisations relying on Quarkus REST Data Panache face a significant security risk due to a code generation flaw that bypasses authentication controls. The vulnerability, identified as CVE-2026-87744, allows unauthenticated attackers to access endpoints that were intended to be secured. This issue stems from how the framework handles specific developer customisations during the build process.

The flaw occurs when a developer customises an operation using the @MethodProperties annotation but fails to explicitly re-declare security roles. According to the National Vulnerability Database, the code generator silently drops class-level security requirements in these instances. Consequently, the affected endpoint defaults to permissive, unauthenticated access, exposing the application to potential abuse by malicious actors.

What we know

The National Vulnerability Database assigns CVE-2026-87744 a CVSS score of 9.1, categorising it as critical. This high severity rating reflects the ease with which an attacker can exploit the flaw without prior authentication. The weakness is classified under CWE-425, which relates to permissive security controls. The vulnerability specifically impacts the Quarkus REST Data Panache extension, a popular tool for simplifying data access in Java applications.

Red Hat Exploit Intelligence and Red Hat build of Quarkus are listed as affected products in the advisory records. The core mechanism of the flaw involves the silent removal of security constraints. When class-level security is defined, developers might assume it applies to all methods. However, adding @MethodProperties without re-stating those roles causes the generator to ignore the original protections.

This behaviour leads to unauthorized information disclosure or data modification. Attackers can interact with the exposed endpoints directly, bypassing the intended access controls. The issue highlights a subtle but dangerous pitfall in framework usage, where standard security assumptions do not hold during code generation. Developers must be vigilant about how annotations interact with inherited security settings.

Defender's checklist

• Review all Quarkus REST Data Panache endpoints for the use of @MethodProperties.
• Verify that security roles are explicitly re-declared on customised operations.
• Check for endpoints that may have silently dropped class-level security requirements.
• Monitor logs for unauthenticated access attempts to sensitive data endpoints.

What to do and how to stay safe: Quarkus

• Audit your codebase for instances where @MethodProperties is used without accompanying security role definitions.
• Implement automated static analysis checks to ensure security annotations are preserved during code generation.
• Test generated endpoints for unexpected unauthenticated access before deploying to production environments.
• Once the vendor provides an update, apply patches promptly to remediate the underlying code generation logic.

Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-87744?

It is a critical vulnerability in Quarkus REST Data Panache that allows unauthenticated access to endpoints by dropping security roles.

How does the flaw occur?

The code generator silently drops class-level security requirements when developers use @MethodProperties without re-declaring security roles.

What is the severity of this vulnerability?

The NVD rates CVE-2026-87744 as critical with a CVSS score of 9.1.