Quarkus Code Gen Flaw: Missing @MethodProperties Security Constraints Enable Unauthenticated Access

A critical vulnerability in Quarkus REST Data Panache enables unauthenticated attackers to bypass security controls. The flaw, identified as CVE-2026-87744, stems from how the framework handles customised operations.

What happened

The issue resides within the Quarkus REST Data Panache component, according to the National Vulnerabilities Database. When developers customise a specific operation using the @MethodProperties annotation, they often fail to explicitly re-declare the necessary security roles. In these instances, the code generator silently discards the class-level security requirements that were previously defined.

This behaviour causes the affected endpoint to default to a permissive state that does not require authentication. The flaw is classified under CWE-425, which relates to missing check for permitted operation. Red Hat Exploit Intelligence confirms that the Red Hat build of Quarkus is among the affected software products.

Why it matters

The vulnerability allows unauthenticated users to access endpoints that should be protected. This bypass can lead to unauthorised information disclosure or data modification by external attackers. The severity is rated as critical with a CVSS score of 9.1. The silent nature of the security drop means developers may not immediately realise their endpoints are exposed. Without explicit re-declaration of roles, the framework removes existing safeguards automatically. This creates a significant attack surface for applications using this specific customisation pattern.

Next steps

• Review codebases for usage of @MethodProperties annotations.
• Verify that security roles are explicitly re-declared in customised operations.
• Check Red Hat advisories for updates to the affected build of Quarkus.
• Audit endpoint permissions to ensure no unintended permissive access exists.

What to do and how to stay safe: Quarkus

• Audit application code for instances where @MethodProperties are used without explicit security role declarations.
• Monitor system logs for unauthenticated access attempts to endpoints that should require credentials.
• Restrict network access to sensitive endpoints until code reviews are completed.
• Ensure development guidelines mandate explicit security role re-declaration when customising operations.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-87744?

The vulnerability has a CVSS score of 9.1, which is rated as critical.

Which software is affected by this flaw?

The Red Hat build of Quarkus is listed as affected by this vulnerability.

How does the bypass occur?

The code generator drops class-level security requirements when @MethodProperties is used without re-declaring roles.