CVE-2026-50559 – Authorization Bypass – Quarkus prior to versions 3.37.0, 3.36.3, 3.33.3, 3.27.5,…

Summary

CVE-2026-50559 is a high-severity HTTP path-based authorization bypass vulnerability in Quarkus, a Java framework for building cloud-native applications. An unauthenticated remote attacker can bypass authorization policies by sending HTTP requests containing specially percent-encoded characters in the URL path, gaining unauthorized access to protected endpoints and static resources. The vulnerability carries a CVSS 3.1 base score of 7.5 (High) and has been patched by the Quarkus project across all supported version streams.

Technical details

• Root cause: A path-normalization inconsistency between Quarkus’s security layer and its routing layer. The security layer evaluates authorization policies against the raw, undecoded URL path — which preserves encoded matrix parameters and path separators — while the routing layer normalizes the path before dispatching requests, stripping those same encoded characters. This mismatch allows crafted URLs to pass authorization checks while still routing to protected endpoints.
• Trigger conditions: An attacker sends an HTTP request to a protected endpoint or static resource with encoded characters embedded in the URL path. No authentication, privileges, or user interaction are required.
• Attack vector: Remote, unauthenticated, over the network. Attackers can exploit the flaw using:
  • Encoded semicolons (%3B) to smuggle matrix parameters past the security layer, causing it to evaluate a path that does not match protected path patterns
  • Encoded forward slashes (%2F) or backslashes (%5C) to traverse path segments and access protected static resources
• Relationship to CVE-2026-39852: This is a distinct issue from CVE-2026-39852, which addressed only literal (unencoded) semicolon stripping. CVE-2026-50559 exploits percent-encoded variants that were not covered by the earlier fix.
• Impact: Unauthorized disclosure of data protected behind path-based authorization policies. Confidentiality impact is rated High; integrity and availability are not affected.

Affected software

• Quarkus all versions prior to 3.20.6.2
• Quarkus 3.27.x prior to 3.27.4.1
• Quarkus 3.33.x prior to 3.33.2.1
• Quarkus 3.36.x prior to 3.36.3
• Quarkus all versions prior to 3.37.0

Severity

• CVSS v3.1 Base Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Mitigation and recommended actions

• Immediate action — upgrade to a patched release:

  • 3.37.0 (latest)
  • 3.36.3
  • 3.33.3 or 3.33.2.1
  • 3.27.5 or 3.27.4.1
  • 3.20.6.2

  The Quarkus CLI command quarkus update can be used to apply the upgrade automatically.

• If immediate patching is not feasible: Apply perimeter controls (e.g., WAF or reverse proxy rules) to block or normalize requests containing %3B, %2F, or %5C in URL path segments corresponding to protected resources. This is a temporary measure only — patching remains the required remediation.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-50559 at NIST
• Quarkus Security Advisory (CVE-2026-50559)