Skip to content
← Vulnerability catalog
OFFICIAL CVE RECORD7.4 High

CVE-2026-89058

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat RESTEasy

Default version status: unaffected

  • 0 to < 6.2.19.Finalaffected
  • 7.0.0.Alpha1 to < 7.0.5.Finalaffected

Red Hat Red Hat build of Quarkus 3.27.6.redhat

Default version status: affected

  • 6.2.19.Final-redhat-00003 to < *unaffected

Red Hat Red Hat build of Quarkus 3.33.4.redhat

Default version status: affected

  • 6.2.19.Final-redhat-00003 to < *unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: affected

  • 0:11.9.0-6.el10_2.1 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:3.0.26-20.el9_8.1 to < *unaffected

Red Hat Red Hat build of Apache Camel 4 for Quarkus 3

Default version status: affected

Red Hat Red Hat build of Apicurio Registry 3

Default version status: affected

Red Hat Red Hat build of Debezium 3

Default version status: affected

Red Hat Red Hat Build of Keycloak

Default version status: affected

Red Hat Red Hat Build of Keycloak

Default version status: affected

Red Hat Red Hat Certificate System 10

Default version status: affected

Red Hat Red Hat Certificate System 11

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: unaffected

Red Hat Red Hat Fuse 7

Default version status: affected

Red Hat Red Hat Fuse 7

Default version status: affected

Red Hat Red Hat JBoss Enterprise Application Platform 7

Default version status: affected

Red Hat Red Hat JBoss Enterprise Application Platform 7

Default version status: affected

Red Hat Red Hat JBoss Enterprise Application Platform 7

Default version status: affected

Red Hat Red Hat JBoss Enterprise Application Platform 7

Default version status: affected

Red Hat Red Hat JBoss Enterprise Application Platform 8

Default version status: affected

Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

Default version status: affected

Red Hat Red Hat Satellite 6

Default version status: unaffected

Red Hat Red Hat Single Sign-On 7

Default version status: affected

References