HIGH🇵🇱 Wersja polska

CVE-2023-6394

CVSS 7.4v3.1pub. 2023-12-09upd. 2026-03-24

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Quarkus

    APP
    Quarkus
    < 3.6.0

  • Red Hat Build Of Quarkus

    APP
    Redhat
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2024-12225CRITICAL9.1PL ✓same product

Quarkus WebAuthn: pominięcie uwierzytelnienia przez domyślne endpointy REST

CVE-2022-4116CRITICAL9.8PL ✓same product

RCE w Quarkus Dev UI Config Editor poprzez drive-by localhost attack

CVE-2022-2466CRITICAL9.8PL ✓same product

Quarkus 2.10.x — brak zakończenia kontekstu nagłówków HTTP (HTTP Request Smuggling)

CVE-2021-26291CRITICAL9.1PL ✓same product

Apache Maven: podążanie za niezaufanymi repozytoriami HTTP (MitM)

CVE-2026-50559HIGH7.5same product

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1...