Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-87744
Red Hat Red Hat build of Quarkus 3.27.6.redhat — Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U H H N 9.1 .0039 31.2 —
AFFECTED
Product Versions Fixed
Red Hat build of Quarkus 3.27.6.redhat unspecified 3.27.6.redhat-00004
Red Hat build of Quarkus 3.33.4.redhat unspecified 3.33.4.redhat-00004
Exploit Intelligence unspecified —
TIMELINE
Sep 9 Reserved by redhat
Oct 12 Published (CNA: redhat)
Oct 15 PATCH SHIPPED — CVE-2026-87744 (Red Hat build of Quarkus 3.27.6.redhat). Fixed in Red Hat build of Quarkus 3.27.6.redhat 3.27.6.redhat-00004.
Description
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| September 9, 2026 | Reserved | Reserved by redhat |
| October 12, 2026 | Published | Published (CNA: redhat) |
| October 15, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-87744 (Red Hat build of Quarkus 3.27.6.redhat). Fixed in Red Hat build of Quarkus 3.27.6.redhat 3.27.6.redhat-00004. |
Affected
Affected products and packages — 3 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Red Hat | Red Hat build of Quarkus 3.27.6.redhat | — | — | 3.27.6.redhat-00004 |
| Red Hat | Red Hat build of Quarkus 3.33.4.redhat | — | — | 3.33.4.redhat-00004 |
| Red Hat | Exploit Intelligence | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-87744 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
