s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

CVE-2026-42333

📛 CVE Title

quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations

⬇ Download JSON ⚠ View as Threat

Description

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security scheme configured for one operation can therefore be applied to a different same-method operation whose path only partially resembles the protected template, causing bearer tokens, API keys, or basic credentials to be sent to unintended endpoints. This issue has been patched in versions 2.11.1-lts, 2.16.0-lts, and 2.17.0.

Overview

State
PUBLISHED
Assigner (CNA)
GitHub_M
CVSS severity
MEDIUM
CVSS score
CVSS 6.3 / 10 6.3 6.3 / 10
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Effective score
6.3 / 10 MEDIUM source: CNA overview
CWE(s)
CWE-200
Reserved
2026-04-26
Published
2026-05-09 21:16 UTC
Last updated
2026-05-11 16:58 UTC
Source
https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42333.json
Linked Threat
CVE-2026-42333 — CVE-2026-42333

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published
2026-05-09 20:16:28 UTC
NVD last modified
2026-05-13 16:52:48 UTC
EPSS score
0.0014 (probability of exploitation in next 30 days)
EPSS percentile
33.02% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

NVD / KEV / EPSS data refreshed 2026-05-25 09:31 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID
EUVD-2026-28928
Assigner
GitHub_M
Published
May 9, 2026, 7:16:19 PM
Updated
May 11, 2026, 2:58:48 PM
EUVD base score (CVSS 4.0)
6.3 / 10
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EUVD-reported EPSS
0.1700
Vendors
quarkiverse
Products
quarkus-openapi-generator (< 2.17.0)
quarkus-openapi-generator (< 2.11.1-lts)
quarkus-openapi-generator (< 2.16.0-lts)
Aliases
GHSA-fr8f-rwjx-f32v

ENISA description: Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security scheme configured for one operation can therefore be applied to a different same-method operation whose path only partially resembles the protected template, causing bearer tokens, API keys, or basic credentials to be sent to unintended endpoints. This issue has been patched in versions 2.11.1-lts, 2.16.0-lts, and 2.17.0.

EUVD references (5)

Affected products (1)
VendorProductVersionsPlatforms
quarkiverse quarkus-openapi-generator < 2.11.1-lts (affected), < 2.16.0-lts (affected), < 2.17.0 (affected) —

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

MITRE references (5) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (3)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

NVD-tagged references (6)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

Remediations (16)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

  • CVE-2026-46333: Local Root Privilege Escalation and Credential ...
    web:blog.qualys.com

    Over the following three days the kernel security team developed and reviewed the fix , CVE - 2026 -46333 was assigned, and the patch was committed publicly on 2026 -05-14. We then engaged the linux-distros mailing list, the standard pre-disclosure channel for downstream coordination.

    2026-05-23 21:04 UTC
  • CVE-2026-46333: Linux Kernel Flaw Grants Root via ssh-keysign
    web:dailysecurityreview.com

    Qualys disclosed CVE - 2026 -46333, a nine-year-old Linux privilege escalation flaw that gives local users a reliable path to root on Debian, Fedora, and Ubuntu.

    2026-05-23 21:04 UTC
  • AI Discovers CVE-2026-46333 Linux Kernel Vulnerability
    web:linuxstans.com

    AI-powered code analysis uncovers fourth critical Linux kernel flaw in May 2026 . CVE - 2026 -46333 targets ptrace. Get mitigation steps and patch info here.

    2026-05-23 21:04 UTC
  • Nvd - Cve-2026-23333
    web:nvd.nist.gov

    An official website of the United States government Here's how you know

    2026-05-23 21:04 UTC
  • Security Update Guide - Microsoft
    web:portal.msrc.microsoft.com

    The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

    2026-05-23 21:04 UTC
  • CVE-2026-46333 (ssh-keysign-pwn) Linux kernel vulnerability ... - Ubuntu
    web:ubuntu.com

    An information disclosure security vulnerability in the Linux kernel was publicly disclosed on May 15th, 2026 . The vulnerability was reported by Qualys and fixed in the mainline Linux kernel tree. A proof-of-concept exploit was published soon after public disclosure. The ID CVE - 2026 -46333 was assigned, but the vulnerability is also referred to as "ssh-keysign-pwn", based on the proof-of ...

    2026-05-23 21:04 UTC
  • Nine-Year Linux Kernel Flaw (CVE-2026-46333) Enables Root Exploitation ...
    web:undercodenews.com

    The issue was privately reported to the Linux kernel security team on May 11, 2026 , and a fix was released on May 14, 2026 . However, public disclosure of the patch quickly enabled independent exploit development.

    2026-05-23 21:04 UTC
  • CVE-2026-46333 (ssh-keysign-pwn): The Fourth Linux Kernel Vulnerability ...
    web:www.gotekky.com

    CVE - 2026 -46333, publicly known as ssh-keysign-pwn, is a Linux kernel information disclosure vulnerability disclosed by Qualys on May 14, 2026 . It lets unprivileged users read root-owned files including SSH host private keys and /etc/shadow. This guide explains what it is, why the previous mitigations do not cover it, w

    2026-05-23 21:04 UTC
  • Oracle Critical Patch Update Advisory - April 2026
    web:www.oracle.com

    This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

    2026-05-23 21:04 UTC
  • Patch Tuesday May 2026: Security Updates & CVE Analysis
    web:zecurit.com

    Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

    2026-05-23 21:04 UTC
  • Nvd - Cve-2026-42833
    web:nvd.nist.gov

    An official website of the United States government Here's how you know

    2026-05-26 02:50 UTC
  • US government warns of severe CopyFail bug affecting major versions of ...
    web:techcrunch.com

    A severe security vulnerability affecting almost every version of the Linux operating system has caught defenders off-guard and scrambling to patch after security researchers publicly released ...

    2026-05-26 02:50 UTC
  • CVE-2026-42833 Dynamics 365 On-Prem RCE: Patch Confidence and Readiness ...
    web:windowsforum.com

    Microsoft has published CVE - 2026 -42833 as a Microsoft Dynamics 365 On-Premises remote code execution vulnerability in the Security Update Guide, and as of May 12, 2026 , the most important operational fact is that Microsoft—not merely a third-party scanner or rumor feed—is treating it as a real...

    2026-05-26 02:50 UTC
  • Nine-Year-Old Linux Kernel Flaw CVE-2026-46333 Lets Attackers Steal SSH ...
    web:www.cyberkendra.com

    CVE - 2026 -46333: A nine-year-old Linux kernel ptrace flaw lets unprivileged users steal SSH host keys, /etc/shadow, and gain root. Patch now.

    2026-05-26 02:50 UTC
  • Linux faces its largest security threat in years—here's how to deal ...
    web:www.howtogeek.com

    Here's the list of mitigation solutions available as we go to publication: Ubuntu Red Hat Enterprise Linux SUSE The Red Hat team warns that there may be a "performance impact" for any task that requires Linux kernel cryptograpic features, so you might notice the effects until a patch lets you restore the relevant processes.

    2026-05-26 02:50 UTC
  • Another major Linux security flaw revealed — nine-year ... - TechRadar
    web:www.techradar.com

    The researchers reported the flaw privately to the Linux kernel security team on May 11, 2026 , and the team came back with a patch three days later, on May 14.

    2026-05-26 02:50 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-42333.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42333",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-11T14:58:43.999964Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-11T14:58:48.598Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-fr8f-rwjx-f32v"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "quarkus-openapi-generator",
          "vendor": "quarkiverse",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.11.1-lts"
            },
            {
              "status": "affected",
              "version": "< 2.16.0-lts"
            },
            {
              "status": "affected",
              "version": "< 2.17.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security scheme configured for one operation can therefore be applied to a different same-method operation whose path only partially resembles the protected template, causing bearer tokens, API keys, or basic credentials to be sent to unintended endpoints. This issue has been patched in versions 2.11.1-lts, 2.16.0-lts, and 2.17.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-09T19:16:19.873Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-fr8f-rwjx-f32v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-fr8f-rwjx-f32v"
        },
        {
          "name": "https://github.com/quarkiverse/quarkus-openapi-generator/pull/1586",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quarkiverse/quarkus-openapi-generator/pull/1586"
        },
        {
          "name": "https://github.com/quarkiverse/quarkus-openapi-generator/releases/tag/2.11.1-lts",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quarkiverse/quarkus-openapi-generator/releases/tag/2.11.1-lts"
        },
        {
          "name": "https://github.com/quarkiverse/quarkus-openapi-generator/releases/tag/2.16.0-lts",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quarkiverse/quarkus-openapi-generator/releases/tag/2.16.0-lts"
        },
        {
          "name": "https://github.com/quarkiverse/quarkus-openapi-generator/releases/tag/2.17.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quarkiverse/quarkus-openapi-generator/releases/tag/2.17.0"
        }
      ],
      "source": {
        "advisory": "GHSA-fr8f-rwjx-f32v",
        "discovery": "UNKNOWN"
      },
      "title": "quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42333",
    "datePublished": "2026-05-09T19:16:19.873Z",
    "dateReserved": "2026-04-26T13:26:14.514Z",
    "dateUpdated": "2026-05-11T14:58:48.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}