CVE-2026-42333

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security...

CVE-2026-42333

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security...

io.github.onecx.quarkus:onecx-permissions (>=0.5.0, <=0.7.0), io.github.onecx.quarkus:onecx-permissions-client (>=0.5.0, <=0.7.0) +122 more potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (>=0.1.0, <=2.16.0-lts)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version =0.1.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.0.1, =0.0.1, =0.1.0, =2.2.13, =0.4.0, =2.7.0, =10.0.0, =10.0.0, =10.2.0 and more Source cves: CVE-2026-4...

CVE-2026-42333

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security...

CVE-2026-42333

CVE-2026-42333 affects Quarkus OpenAPI Generator. The issue: the generated authentication filter can match OpenAPI path templates too broadly, causing a security scheme for one operation to be applied to a different, similarly-named operation. This can cause bearer tokens, API keys, or basic cred...

CVE-2026-42333 quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security...

CVE-2026-42333 quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security...

CVE-2026-42333: Exposure of Sensitive Information to an Unauthorized Actor

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.4.0), io.quarkiverse.openapi.generator:quarkus-openapi-generator-generation-input (0.4.0) potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.4.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.5) potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.5)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.12.0), org.kie.kogito:integration-tests-jobs-service-quarkus (>=1.30.0.final, <=1.32.0.final) +9 more potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.12.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.4.1), io.quarkiverse.openapi.generator:quarkus-openapi-generator-generation-input (0.4.1) potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.4.1)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.16) potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.16)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.16 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.10) potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.10)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.github.onecx.quarkus:onecx-permissions (>=0.5.0, <=0.7.0), io.github.onecx.quarkus:onecx-permissions-client (>=0.5.0, <=0.7.0) +73 more potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (>=2.0.0, <=2.11.0-lts)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version =2.0.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.0.1, =0.0.1, =2.0.0, =2.2.13, =2.7.0, =10.0.0, =10.0.0, =10.0.0, =10.2.0 and more Source cves: CVE-2026...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.4) potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.4)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.3) potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.3)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.11.0), org.kie.kogito:integration-tests-jobs-service-quarkus (>=1.28.0.final, <=1.29.0.final) +9 more potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.11.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.3.1) potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.3.1)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.11) potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.11)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.11 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...