CVE-2026-42333 quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations
Overly broad path matching in Quarkus OpenAPI Generator leaks authentication credentials to unintended endpoints, exposing sensitive tokens to attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42333?
CVE-2026-42333 is a medium-severity vulnerability in quarkiverse quarkus-openapi-generator, published on 9 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security scheme configured for one operation can therefore be applied to a different same-method operation whose path only partially resembles the protected template, causing bearer tokens, API keys, or basic credentials to be sent to unintended endpoints. This issue has been patched in versions 2.11.1-lts, 2.16.0-lts, and 2.17.0.
Weakness: CWE-200
Which versions are affected by CVE-2026-42333?
4 open source packages ship an affected version, including io.quarkiverse.openapi.generator:quarkus-openapi-generator.
| Package | Affected | Fixed in |
|---|---|---|
io.quarkiverse.openapi.generator:quarkus-openapi-generator Maven | All versions | 2.16.0-lts |
io.quarkiverse.openapi.generator:quarkus-openapi-generator Maven | All versions | 2.16.0-lts |
io.quarkiverse.openapi.generator:quarkus-openapi-generator Maven | From 2.16.0 | 2.17.0 |
io.quarkiverse.openapi.generator:quarkus-openapi-generator Maven | From 2.16.0 | 2.17.0 |
How do I fix CVE-2026-42333?
Upgrade io.quarkiverse.openapi.generator:quarkus-openapi-generator to a fixed version for your release line: 2.16.0-lts or 2.17.0.
Is CVE-2026-42333 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42333 exists.
Sources
Also known as GHSA-fr8f-rwjx-f32v.