CVE-2026-94451
6.5MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-20
Impact
Remote, unauthenticated attackers can access restricted entity data or trigger denial-of-service by overloading the backend database. They only need network access to reach automatically generated REST Data Panache endpoints.
Root cause
Quarkus REST Data Panache endpoints fail to validate or sanitize user-supplied sort parameters passed directly to database queries.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Fix & remediation
Upgrade Quarkus REST Data Panache dependencies to the patched versions referenced in RHSA-2026:83082 and RHSA-2026:83520. If patching immediately is not possible, disable or place restrictive WAF/reverse proxy filters on the 'sort' query parameter for Panache REST endpoints.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service.