Skip to content
Fencer Vulns
high 7.4

CVE-2026-89058 json

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

published 2026-09-18 52 d ago modified 2026-11-09 15 h ago also EUVD-2026-82736

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

Patch / fix

  • Red Hat Red Hat Build of Apache Camel 3.33.4.redhat 6.2.19.Final-redhat-00003
  • Red Hat Red Hat build of Quarkus 3.27.6.redhat 6.2.19.Final-redhat-00003
  • Red Hat Red Hat build of Quarkus 3.33.4.redhat 6.2.19.Final-redhat-00003
  • Red Hat Red Hat Enterprise Linux 10 0:11.9.0-6.el10_2.1
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:11.6.0-3.el10_0.2
  • Red Hat Red Hat Enterprise Linux 9 0:3.0.26-20.el9_8.1
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:3.0.26-16.el9_2.1
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:3.0.26-20.el9_4.2
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:3.0.26-20.el9_6.2
  • resteasy RHEL 9 3.0.26-20.el9_8.1
  • pki-resteasy-core RHEL 9 3.0.26-20.el9_8.1
  • pki-resteasy-client RHEL 9 3.0.26-20.el9_8.1
  • pki-resteasy-jackson2-provider RHEL 9 3.0.26-20.el9_8.1
  • pki-resteasy-servlet-initializer RHEL 9 3.0.26-20.el9_8.1

red hat advisories RHSA-2026:85234

  • idm-pki-ca AlmaLinux 10 11.9.0-6.el10_2.1.alma.1
  • idm-pki-kra AlmaLinux 10 11.9.0-6.el10_2.1.alma.1
  • idm-pki-acme AlmaLinux 10 11.9.0-6.el10_2.1.alma.1
  • idm-pki-base AlmaLinux 10 11.9.0-6.el10_2.1.alma.1
  • idm-pki-java AlmaLinux 10 11.9.0-6.el10_2.1.alma.1
  • idm-pki-tools AlmaLinux 10 11.9.0-6.el10_2.1.alma.1
  • idm-pki-server AlmaLinux 10 11.9.0-6.el10_2.1.alma.1
  • python3-idm-pki AlmaLinux 10 11.9.0-6.el10_2.1.alma.1

almalinux advisories ALSA-2026:92408ALSA-2026:85234

  • dogtag-pki Rocky Linux 10 11.9.0-6.el10_2.1.rocky.0.1
  • resteasy Rocky Linux 9 3.0.26-20.el9_8.1

rocky linux advisories RLSA-2026:92408RLSA-2026:85234

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-89058 updated cvss 7.4

resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config

  • Red Hat build of Apache Camel 4 for Quarkus 3 resteasy-core
    affected: no fix available
  • Red Hat build of Apicurio Registry 3 resteasy-core
    affected: no fix available “Fix deferred”
  • Red Hat build of Debezium 3 resteasy-core Red Hat Build of Keycloak resteasy-core, rhbk/keycloak-rhel9-operator Red Hat Certificate System 10 redhat-pki Red Hat Certificate System 11 redhat-pki
    affected: no fix available
  • Red Hat Fuse 7 resteasy-core, resteasy-jaxrs Red Hat JBoss Enterprise Application Platform 7 resteasy-jaxrs, jboss-eap-7/eap74-els-openjdk8-openshift-rhel8, jboss-eap-7/eap74-els-openjdk11-openshift-rhel8, jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack resteasy-core
    affected: no fix available
  • Red Hat Single Sign-On 7 resteasy-jaxrs
    affected: no fix available “Fix deferred”
  • Red Hat Build of Apache Camel 3.33.4.redhat resteasy-core 6.2.19.Final-redhat-00003
    fixed: vendor fix RHSA-2026:83670
  • Red Hat build of Quarkus 3.27.6.redhat resteasy-core 6.2.19.Final-redhat-00003
    fixed: vendor fix RHSA-2026:83082
show 12 more
  • Red Hat build of Quarkus 3.33.4.redhat resteasy-core 6.2.19.Final-redhat-00003
    fixed: vendor fix RHSA-2026:83520
  • Red Hat Enterprise Linux AppStream (v. 9) resteasy 3.0.26-20.el9_8.1, pki-resteasy-core 3.0.26-20.el9_8.1, pki-resteasy-client 3.0.26-20.el9_8.1, pki-resteasy-jackson2-provider 3.0.26-20.el9_8.1, pki-resteasy-servlet-initializer 3.0.26-20.el9_8.1
    fixed: vendor fix RHSA-2026:85234
  • Red Hat Enterprise Linux AppStream (v. 10) dogtag-pki 11.9.0-6.el10_2.1, idm-pki-ca 11.9.0-6.el10_2.1, idm-pki-kra 11.9.0-6.el10_2.1, idm-pki-acme 11.9.0-6.el10_2.1, idm-pki-base 11.9.0-6.el10_2.1, idm-pki-java 11.9.0-6.el10_2.1, +3 more
    fixed: vendor fix RHSA-2026:92408
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) resteasy 3.0.26-16.el9_2.1, pki-resteasy-core 3.0.26-16.el9_2.1, pki-resteasy-client 3.0.26-16.el9_2.1, pki-resteasy-jackson2-provider 3.0.26-16.el9_2.1
    fixed: vendor fix RHSA-2026:96077
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) resteasy 3.0.26-20.el9_4.2, pki-resteasy-core 3.0.26-20.el9_4.2, pki-resteasy-client 3.0.26-20.el9_4.2, pki-resteasy-jackson2-provider 3.0.26-20.el9_4.2, pki-resteasy-servlet-initializer 3.0.26-20.el9_4.2
    fixed: vendor fix RHSA-2026:95505
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) dogtag-pki 11.6.0-3.el10_0.2, idm-pki-ca 11.6.0-3.el10_0.2, idm-pki-kra 11.6.0-3.el10_0.2, idm-pki-acme 11.6.0-3.el10_0.2, idm-pki-base 11.6.0-3.el10_0.2, idm-pki-java 11.6.0-3.el10_0.2, +3 more
    fixed: vendor fix RHSA-2026:95466
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) resteasy 3.0.26-20.el9_6.2, pki-resteasy-core 3.0.26-20.el9_6.2, pki-resteasy-client 3.0.26-20.el9_6.2, pki-resteasy-jackson2-provider 3.0.26-20.el9_6.2, pki-resteasy-servlet-initializer 3.0.26-20.el9_6.2
    fixed: vendor fix RHSA-2026:95504
  • Red Hat JBoss Enterprise Application Platform 8.1
    fixed: vendor fix RHSA-2026:95221
  • Red Hat Build of Apache Camel 3.33.4.redhat jimfs 1.1, jna 5.8.0, bcel 6.7.0, gax 2.74.1, icu4j 78.2, joni 2.2.6, +1616 more Red Hat build of Quarkus 3.27.6.redhat jna 5.8.0, db2 1.21.4, h2 2.3.230, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, +1009 more Red Hat build of Quarkus 3.33.4.redhat jna 5.8.0, h2 2.4.240, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, wasm 2.15.3, +1016 more
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 8 jss, pki-ca, idm-jss, ldapjdk, pki-kra, pki-acme, +25 more
    not affected: component not present
  • Red Hat Enterprise Linux 9 pki-ca, pki-kra, pki-acme, pki-base, pki-core, pki-tools, +16 more
    not affected: vulnerable code not present
  • Red Hat Satellite 6 candlepin, candlepin-selinux
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
52 d ago

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/resteasy/resteasy/security/advisories/GHSA-972r-f3fv-whm3 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Affected products

  • Red Hat Red Hat Build of Apache Camel 3.33.4.redhat
  • Red Hat Red Hat build of Quarkus 3.27.6.redhat
  • Red Hat Red Hat build of Quarkus 3.33.4.redhat
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat Certificate System 10
  • Red Hat Red Hat Certificate System 11
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Single Sign-On 7

Classification

Weakness
  • CWE-346 Origin Validation Error
  • CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.