Read the docs
TI-2026-30637 Aliases CVE-2026-42333GHSA-fr8f-rwjx-f32v

Information disclosure in quarkiverse quarkus-openapi-generator

Priority HIGH 67CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security scheme configured for one operation can therefore be applied to a different same-method operation whose path only partially resembles the protected template, causing bearer tokens, API keys, or basic credentials to be sent to unintended endpoints. This issue has been patched in versions 2.11.1-lts, 2.16.0-lts, and 2.17.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.004 34th percentileScored 2026-11-07
Fix Fixed quarkus-openapi-generator (quarkiverse): 2.11.1-lts, 2.16.0-lts, 2.17.0io.quarkiverse.openapi.generator:quarkus-openapi-generator (Maven): 2.16.0-lts, 2.17.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
quarkiversequarkus-openapi-generatorbefore 2.11.1-lts; before 2.16.0-lts; before 2.17.02.11.1-lts, 2.16.0-lts, 2.17.0Patch availableCNA
—io.quarkiverse.openapi.generator:quarkus-openapi-generator (Maven)before 2.16.0-lts2.16.0-ltsPatch availableGHSA-fr8f-rwjx-f32v
—io.quarkiverse.openapi.generator:quarkus-openapi-generator (Maven)2.16.0 to before 2.17.02.17.0Patch availableGHSA-fr8f-rwjx-f32v
  • quarkus-openapi-generator Vendorquarkiverse Affected before 2.11.1-lts; before 2.16.0-lts; before 2.17.0 Fixed in 2.11.1-lts, 2.16.0-lts, 2.17.0 Patch available CNA
  • io.quarkiverse.openapi.generator:quarkus-openapi-generator (Maven) Vendor— Affected before 2.16.0-lts Fixed in 2.16.0-lts Patch available GHSA-fr8f-rwjx-f32v
  • io.quarkiverse.openapi.generator:quarkus-openapi-generator (Maven) Vendor— Affected 2.16.0 to before 2.17.0 Fixed in 2.17.0 Patch available GHSA-fr8f-rwjx-f32v

Remediation

  • Fix · CNA quarkus-openapi-generator (quarkiverse) Fixed in 2.11.1-lts, 2.16.0-lts, 2.17.0
  • Fix · GHSA-fr8f-rwjx-f32v io.quarkiverse.openapi.generator:quarkus-openapi-generator (Maven) Fixed in 2.16.0-lts Advisory →
  • Fix · GHSA-fr8f-rwjx-f32v io.quarkiverse.openapi.generator:quarkus-openapi-generator (Maven) Fixed in 2.17.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42333
  2. 2026-10-03 Alias added: GHSA-fr8f-rwjx-f32v
  3. 2026-10-09 EPSS moved to the 50th–90th percentile
  4. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

Other 6

  • TI-2026-28994 Zip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper class CVSS 4.0HIGH 7.7
  • TI-2026-70726 Quarkus LangChain4j Memory Exhaustion via /_chat/routes WebSocket CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences