Read the docs
TI-2023-05869 Aliases CVE-2023-6394GHSA-mvc8-6ffp-jrx5

Quarkus: graphql operations over websockets bypass

Priority MEDIUM 43CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862.

Summary

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00807 57th percentileScored 2026-11-07
Fix Partial io.quarkus:quarkus-smallrye-graphql-client (Maven): 3.5.3, 2.13.9.FinalRed Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat build of Quarkus 2.13.9——Not affectedCNA
Red HatRed Hat build of Quarkus 3.2.9.Final—3.2.9.Final-redhat-00002Patch availableCNA
Red HatRed Hat build of Quarkus——No fix listedCNA
—io.quarkus:quarkus-smallrye-graphql-client (Maven)2.14.0 to before 3.5.33.5.3Patch availableGHSA-mvc8-6ffp-jrx5
—io.quarkus:quarkus-smallrye-graphql-client (Maven)before 2.13.9.Final2.13.9.FinalPatch availableGHSA-mvc8-6ffp-jrx5
  • Red Hat build of Quarkus 2.13.9 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Quarkus 3.2.9.Final VendorRed Hat Affected — Fixed in 3.2.9.Final-redhat-00002 Patch available CNA
  • Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — No fix listed CNA
  • io.quarkus:quarkus-smallrye-graphql-client (Maven) Vendor— Affected 2.14.0 to before 3.5.3 Fixed in 3.5.3 Patch available GHSA-mvc8-6ffp-jrx5
  • io.quarkus:quarkus-smallrye-graphql-client (Maven) Vendor— Affected before 2.13.9.Final Fixed in 2.13.9.Final Patch available GHSA-mvc8-6ffp-jrx5

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*before 3.6.0Vulnerablequarkusio
cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 3.6.0 Vulnerable ·quarkusio
  • cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-mvc8-6ffp-jrx5 io.quarkus:quarkus-smallrye-graphql-client (Maven) Fixed in 3.5.3 Advisory →
  • Fix · GHSA-mvc8-6ffp-jrx5 io.quarkus:quarkus-smallrye-graphql-client (Maven) Fixed in 2.13.9.Final Advisory →

Red Hat 2 advisories

  • RHSA-2023:7700 Released 2023-12-07 · Red Hat rating Important
    Red Hat build of Quarkus 2.13.9 release and security update
    • Red Hat build of Quarkus 2.13.9
  • RHSA-2023:7612 Released 2023-11-30 · Red Hat rating Important
    Red Hat build of Quarkus 3.2.9 release and security update
    • Red Hat build of Quarkus 3.2.9.Final io.quarkus.quarkus-smallrye-graphql-3.2.9.Final-redhat-00002.jar, org.apache.avro.avro-1.11.3.redhat-00002.jar, org.xerial.snappy.snappy-java-1.1.10.5-redhat-00001.jar

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat build of Quarkus — RHSA-2023:7700

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2023-05868 Quarkus: potential invalid reuse of context when @cacheresult on a uni is usedPriority LOW 25
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of QuarkusAffectedNo fix yet
Red Hat build of Quarkus 2.13.9Fixed RHSA-2023:7700
Red Hat build of Quarkus 3.2.9.FinalFixed RHSA-2023:7612
Not affected: 1 product
  • Red Hat build of Quarkus 3.2.9.Final

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-6394
  2. 2026-10-03 Alias added: GHSA-mvc8-6ffp-jrx5
  3. 2026-10-20 Affected versions changed · CNA
  4. 2026-10-20 Fix available: Red Hat build of Quarkus 2.13.9 · Red Hat

References

Advisory 4

Other 5

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2022-03763 Injection in quarkus CVSS 3.1CRITICAL 9.8
  • TI-2023-04469 Quarkus: http security policy bypass CVSS 3.1HIGH 8.1
  • TI-2022-04106 Server-side request forgery in undertow CVSS 3.1HIGH 7.5
  • TI-2023-02786 Quarkus-core: tls protocol configured with quarkus.http.ssl.protocols is not enforced… CVSS 3.1HIGH 8.1
  • TI-2023-01048 Undertow: infinite loop in sslconduit during close CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences