CVE-2026-121837— Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort
Quick assessment
Affected
Red Hat Exploit Intelligence
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Quarkus 的 REST Data Panache 组件中发现了一个安全缺陷。当使用 注解在实体属性的 getter 方法（而非属性字段本身）上应用安全约束时，生成的 REST 资源无法在过滤和排序操作中正确执行该约束。这导致已认证用户可以通过观察哪些记录符合特定过滤条件，或记录如何排序，从而推断出敏感数据的值，尽管这些值并未出现在最终响应中。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-121837
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering and sorting operations. This allows an authenticated user to infer sensitive data values by observing which records match specific filter criteria or how they are ordered, even though the values are omitted from the final response.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Exploit Intelligence | - |
cpe:/a:redhat:exploit_intelligence:0
|
|
| Red Hat | Red Hat build of Quarkus | - |
cpe:/a:redhat:quarkus:3
|
|
II. Public POCs for CVE-2026-121837
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-121837
请登录查看更多情报信息。
Other References for CVE-2026-121837 (2)
Same Patch Batch · Red Hat · 2026-11-06 · 15 CVEs total
| CVE-2026-109081 | 6.8 MEDIUM | Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr |
| CVE-2026-19688 | 6.8 MEDIUM | Keycloak-services: keycloak-services: admin api missing audience check |
| CVE-2026-123037 | 6.7 MEDIUM | Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privi |
| CVE-2026-96547 | 6.5 MEDIUM | Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging |
| CVE-2026-97848 | 6.5 MEDIUM | Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sa |
| CVE-2026-9797 | 6.5 MEDIUM | Keycloak: keycloak: privilege escalation via client authentication manipulation by an auth |
| CVE-2026-107124 | 6.4 MEDIUM | Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_h |
| CVE-2026-97367 | 6.4 MEDIUM | Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account re |
| CVE-2026-120749 | 6.2 MEDIUM | Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver |
| CVE-2026-96460 | 5.4 MEDIUM | Keycloak-services: keycloak-services: indefinite access token renewal via standard token e |
| CVE-2026-92856 | 4.9 MEDIUM | Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation cons |
| CVE-2026-96447 | 4.2 MEDIUM | Keycloak-services: keycloak-services: stateless token preferred_username fallback enables |
| CVE-2026-83493 | Distributed-workloads: github actions pinned by mutable tag/branch, including third-party | |
| CVE-2026-83494 | Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby |
IV. Related Vulnerabilities
Same vendor: Red Hat
-
CVE-2026-120749
Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) wh -
CVE-2026-83494
Training-operator: pytorchjob validateupdate casts oldjob fr -
CVE-2026-83493
Distributed-workloads: github actions pinned by mutable tag/ -
CVE-2026-9797
Keycloak: keycloak: privilege escalation via client authenti -
CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with j