CVE-2026-42333

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42333
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42333.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42333
Aliases
Published
2026-05-09T19:16:19.873Z
Modified
2026-07-08T08:12:35.216834049Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations
Details

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security scheme configured for one operation can therefore be applied to a different same-method operation whose path only partially resembles the protected template, causing bearer tokens, API keys, or basic credentials to be sent to unintended endpoints. This issue has been patched in versions 2.11.1-lts, 2.16.0-lts, and 2.17.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42333.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ]
}
References

Affected packages

Git / github.com/quarkiverse/quarkus-openapi-generator

Affected ranges

Type
GIT
Repo
https://github.com/quarkiverse/quarkus-openapi-generator
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
111c80ebbb9d702b4fcbee0bf7bca25615426d88
Fixed
9a83538901993061b9e85c321e01c88c8d4a63ad
Fixed
a58aea80e78648ad55ceaede0853d08ca17927f9
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.11.1-lts"
        },
        {
            "fixed": "2.16.0-lts"
        },
        {
            "fixed": "2.17.0"
        }
    ]
}

Affected versions

0.*
0.1.0
0.10.0
0.11.0
0.12.0
0.2.0
0.3.1
0.4.0
0.4.1
0.5.0
0.6.0
0.6.1
0.7.0
0.8.0
0.9.0
1.*
1.0.0
1.0.1
2.*
2.0.0
2.1.0
2.1.1
2.10.0-lts
2.11.0-lts
2.12.0-lts
2.12.1-lts
2.13.0-lts
2.14.0-lts
2.15.0-lts
2.16.0-lts
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.2
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.3.0
2.4.0
2.4.1
2.4.2
2.4.6
2.4.7
2.5.0
2.6.0-lts
2.7.0-lts
2.7.1-lts
2.8.0-lts
2.8.1-lts
2.8.2-lts
2.9.0-lts
2.9.1-lts

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42333.json"