PT-2026-37202
CVE-2026-42333
·
Published
2026-05-04
·
Updated
2026-05-09
Description by
CVSS 4.0
6.3
MediumMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Quarkus OpenAPI Generator versions prior to 2.11.1-lts
Quarkus OpenAPI Generator versions prior to 2.16.0-lts
Quarkus OpenAPI Generator versions prior to 2.17.0
Description
The generated authentication filter matches OpenAPI path templates too broadly when determining whether to attach credentials. The runtime authentication layer compares the outgoing request path and method against protected OpenAPI operations, but treats
{param} placeholders as .*, which incorrectly allows a single path parameter to consume a forward slash (/). Consequently, a security scheme configured for one operation may be applied to a different operation of the same method if the path partially resembles the protected template. This can lead to bearer tokens, API keys, or basic credentials being sent to unintended endpoints, potentially disclosing sensitive information to lower-trust routes on the same service.Recommendations
Update to version 2.11.1-lts.
Update to version 2.16.0-lts.
Update to version 2.17.0.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾