CVE-2026-42333 Details
Description
Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security scheme configured for one operation can therefore be applied to a different same-method operation whose path only partially resembles the protected template, causing bearer tokens, API keys, or basic credentials to be sent to unintended endpoints. This issue has been patched in versions 2.11.1-lts, 2.16.0-lts, and 2.17.0.
A vulnerability exists in Quarkus OpenAPI Generator versions prior to 2.11.1-lts, 2.16.0-lts, and 2.17.0. The issue arises because the generated authentication filter overly broadens the matching of OpenAPI path templates when determining whether to attach credentials. This flaw can lead to security schemes intended for one operation being incorrectly applied to another operation with a similar path, but not identical, causing sensitive credentials like bearer tokens, API keys, or basic authentication to be sent to the wrong endpoints. The vulnerability can be exploited through normal use of the generated client, without any need to alter the generated code.
Users can upgrade to Quarkus OpenAPI Generator versions 2.11.1-lts, 2.16.0-lts, or 2.17.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 9, 2026CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-fr8f-rwjx-f32v | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/quarkiverse/quarkus-openapi-generator/pull/1586 | [email protected] | Issue TrackingVendor |
| https://github.com/quarkiverse/quarkus-openapi-generator/releases/tag/2.11.1-lts | [email protected] | Release NotesVendor |
| https://github.com/quarkiverse/quarkus-openapi-generator/releases/tag/2.16.0-lts | [email protected] | Release NotesVendor |
| https://github.com/quarkiverse/quarkus-openapi-generator/releases/tag/2.17.0 | [email protected] | Release NotesVendor |
| https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-fr8f-rwjx-f32v | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Quarkus OpenAPI Generator | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 9, 2026 | New CVE Received | [email protected] |