Skip to content
Fencer Vulns
medium 5.3

CVE-2026-81829 json

Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver

published 2026-09-17 53 d ago modified 2026-10-09 31 d ago also EUVD-2026-81617

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-81829 updated cvss 5.3

smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver

  • Red Hat Exploit Intelligence exploit-intelligence/agent-client-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat build of Apicurio Registry 3 quarkus-smallrye-jwt, smallrye-jwt 4.6.2.redhat-00001
    affected: workaround, no fix available, no fix planned “Out of support scope”
  • Red Hat build of Quarkus smallrye-jwt 4.6.2.redhat-00001 Red Hat JBoss Enterprise Application Platform 8 smallrye-jwt 4.6.2.redhat-00001 Red Hat JBoss Enterprise Application Platform Expansion Pack smallrye-jwt 4.6.2.redhat-00001
    affected: workaround, no fix available “Fix deferred”
  • Red Hat build of Quarkus 3.27.5.SP2
    fixed: vendor fix RHSA-2026:69470
  • Red Hat build of Quarkus 3.33.3.SP2
    fixed: vendor fix RHSA-2026:69440

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
53 d ago

Exploit prediction

0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

  • Red Hat Red Hat build of Quarkus 3.27.5.SP2
  • Red Hat Red Hat build of Quarkus 3.33.3.SP2
  • Red Hat Exploit Intelligence
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Quarkus
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.