CVE-2026-19651

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19651", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-08-12T17:38:20.473Z", "datePublished": "2026-09-08T20:14:12.902Z", "dateUpdated": "2026-09-09T13:27:49.159Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-09-08T20:14:12.902Z"}, "title": "IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Enterprise Build of Quarkus", "versions": [{"status": "affected", "version": "3.27.1", "lessThanOrEqual": "3.27.5", "versionType": "semver"}, {"status": "affected", "version": "3.33.1", "lessThanOrEqual": "3.33.3", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7286498", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "solutions": [{"lang": "en", "value": "The issues are addressed in IBM Enterprise Build of Quarkus 3.27.5.SP1 and 3.33.3.SP1. To update your project to IBM Enterprise Build of Quarkus 3.27.5.SP1 or 3.33.3.SP1, follow the instructions in the product documentation https://www.ibm.com/docs/en/quarkus/3.27.x .", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The issues are addressed in IBM Enterprise Build of Quarkus 3.27.5.SP1 and 3.33.3.SP1. To update your project to IBM Enterprise Build of Quarkus 3.27.5.SP1 or 3.33.3.SP1, follow the instructions in the <a href=\"https://www.ibm.com/docs/en/quarkus/3.27.x?topic=overview-learn-whats-new-in-327#proc_updating-quarkus-maven\" rel=\"nofollow\">product documentation</a>.</p>"}]}], "credits": [{"lang": "en", "value": "Michael Read (https://github.com/Michael-JRead) , Michael Read (https://github.com/Michael-JRead)", "type": "finder"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-09T13:27:41.882596Z", "id": "CVE-2026-19651", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-09T13:27:49.159Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19651", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-09T13:27:41.882596Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-09T13:27:46.547Z"}}], "cna": {"title": "IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities", "credits": [{"lang": "en", "type": "finder", "value": "Michael Read (https://github.com/Michael-JRead) , Michael Read (https://github.com/Michael-JRead)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Enterprise Build of Quarkus", "versions": [{"status": "affected", "version": "3.27.1", "versionType": "semver", "lessThanOrEqual": "3.27.5"}, {"status": "affected", "version": "3.33.1", "versionType": "semver", "lessThanOrEqual": "3.33.3"}]}], "solutions": [{"lang": "en", "value": "The issues are addressed in IBM Enterprise Build of Quarkus 3.27.5.SP1 and 3.33.3.SP1. To update your project to IBM Enterprise Build of Quarkus 3.27.5.SP1 or 3.33.3.SP1, follow the instructions in the product documentation https://www.ibm.com/docs/en/quarkus/3.27.x .", "supportingMedia": [{"type": "text/html", "value": "<p>The issues are addressed in IBM Enterprise Build of Quarkus 3.27.5.SP1 and 3.33.3.SP1. To update your project to IBM Enterprise Build of Quarkus 3.27.5.SP1 or 3.33.3.SP1, follow the instructions in the <a href=\"https://www.ibm.com/docs/en/quarkus/3.27.x?topic=overview-learn-whats-new-in-327#proc_updating-quarkus-maven\" rel=\"nofollow\">product documentation</a>.</p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7286498", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en", "value": "IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-09-08T20:14:12.902Z"}}}, "cveMetadata": {"cveId": "CVE-2026-19651", "state": "PUBLISHED", "dateUpdated": "2026-09-09T13:27:49.159Z", "dateReserved": "2026-08-12T17:38:20.473Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-09-08T20:14:12.902Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3:*:*:*:*:*:*:*"], "product": "Enterprise Build of Quarkus", "vendor": "IBM", "versions": [{"lessThanOrEqual": "3.27.5", "status": "affected", "version": "3.27.1", "versionType": "semver"}, {"lessThanOrEqual": "3.33.3", "status": "affected", "version": "3.33.1", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input."}], "id": "CVE-2026-19651", "lastModified": "2026-09-09T15:41:55.983", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19651", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-09T13:27:41.882596Z", "version": "2.0.3"}}]}, "published": "2026-09-08T21:17:06.777", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7286498"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{"bugzilla": {"description": "quarkus-spring-web: quarkus-spring-web: Authorization bypass via URL query string manipulation", "id": "2517694", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517694"}, "csaw": false, "cwe": "CWE-551", "details": ["A flaw was found in quarkus-spring-web. A remote attacker could exploit this vulnerability by manipulating the URL query string. The system incorrectly reads the URL query string as a request header, which can lead to an authorization bypass, allowing unauthorized access to resources."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-19651", "package_state": [{"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Affected", "package_name": "quarkus-spring-web", "product_name": "Red Hat build of Quarkus"}], "public_date": "2026-08-31T11:29:32Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-19651\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-19651"], "statement": "Important: This flaw in quarkus-spring-web allows for an authorization bypass by incorrectly interpreting URL query string parameters as request headers. This could enable unauthorized access to resources or functionality within applications utilizing the affected component, elevating the risk to Important due to the potential for privilege escalation or data exposure.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "product": "quarkus-spring-web", "vendor": "quarkus"}], "created": "2026-09-01T13:45:05.283500+00:00", "updated": "2026-09-09T10:30:09.165585+00:00", "vendors": ["quarkus", "quarkus$PRODUCT$quarkus-spring-web"]}