RESTEasy CorsFilter CORS Misconfig Enables Credentialed CrossOrigin Access
CVE-2026-89058 Published on September 18, 2026

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-89058 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-89058. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Timeline

Reported to Red Hat.

Made public. 29 days later.

Weakness Types

Origin Validation Error

The software does not properly verify that the source of data or communication is valid.

Permissive Cross-domain Policy with Untrusted Domains

The software uses a cross-domain policy file that includes domains that should not be trusted.


Products Associated with CVE-2026-89058

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Camel Quarkus
 
Red Hat Apicurio Registry
 
Red Hat Debezium
 
Red Hat Build Keycloak
 
Red Hat Quarkus
 
Red Hat Certificate System
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Jboss Fuse
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Jbosseapxp
 
Red Hat Satellite
 
Red Hat Single Sign On
 
Red Hat Jboss Enterprise Application Platform Xp
 

Affected Versions

Red Hat RESTEasy: Red Hat build of Quarkus 3.27.6.redhat: Red Hat build of Quarkus 3.33.4.redhat: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 9: Red Hat JBoss Enterprise Application Platform 8.1: Red Hat build of Apache Camel 4 for Quarkus 3: Red Hat build of Apicurio Registry 3: Red Hat build of Debezium 3: Red Hat Build of Keycloak: Red Hat Build of Keycloak: Red Hat Certificate System 10: Red Hat Certificate System 11: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Fuse 7: Red Hat Fuse 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat Satellite 6: Red Hat Single Sign-On 7: