Medium severity · published Oct 12, 2026
CVE-2026-94451
Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EI
Exploit Intelligence · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Quarkus 3.27.6.redhat · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Quarkus 3.33.4.redhat · Red Hat
All versions, or not specified · source: vendor
Affected product
EI
Exploit Intelligence
Red Hat
More from Exploit Intelligence
6.5
CVE-2026-48710
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
9.8
CVE-2026-49468
LiteLLM: Authentication Bypass via Host Header Injection
9.8
CVE-2026-12773
BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication
9.1
CVE-2026-87744
Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations
9.1
CVE-2026-48746
vLLM: OpenAI auth bypass