CVE-2026-89058
Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config
- Published
- Updated
- Reserved
- Assigned by
- redhat
Description
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.
Public exploit
A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.
Timeline
ID reserved
By redhat
- 8 days later
· 8 days later
Published
- 49 days later
· 49 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| redhatCNA (assigner) | 3.1 | High7.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
| NVDNVD · Awaiting Analysis | 3.1 | High7.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.47% · top 59% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.4.
Weakness
Affected products
- affected < 6.2.19.Final
- affected 7.0.0.Alpha1 – < 7.0.5.Final
Red Hat · Red Hat Build of Apache Camel 3.33.4.redhat
- unaffected 6.2.19.Final-redhat-00003 – < *
Red Hat · Red Hat build of Quarkus 3.27.6.redhat
- unaffected 6.2.19.Final-redhat-00003 – < *
Red Hat · Red Hat build of Quarkus 3.33.4.redhat
- unaffected 6.2.19.Final-redhat-00003 – < *
Red Hat · Red Hat Enterprise Linux 10
- unaffected 0:11.9.0-6.el10_2.1 – < *
Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support
- unaffected 0:11.6.0-3.el10_0.2 – < *
Red Hat · Red Hat Enterprise Linux 9
- unaffected 0:3.0.26-20.el9_8.1 – < *
Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
- unaffected 0:3.0.26-20.el9_4.2 – < *
Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support
- unaffected 0:3.0.26-20.el9_6.2 – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1
All versions: unaffected
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1
All versions: unaffected
Red Hat · Red Hat build of Apache Camel 4 for Quarkus 3
All versions: affected
Red Hat · Red Hat build of Apicurio Registry 3
All versions: affected
Red Hat · Red Hat build of Debezium 3
All versions: affected
Red Hat · Red Hat Build of Keycloak
All versions: affected
Red Hat · Red Hat Build of Keycloak
All versions: affected
Red Hat · Red Hat Certificate System 10
All versions: affected
Red Hat · Red Hat Certificate System 11
All versions: affected
Red Hat · Red Hat Enterprise Linux 8
All versions: unaffected
Red Hat · Red Hat Enterprise Linux 9
All versions: unaffected
Red Hat · Red Hat Enterprise Linux 9
All versions: unaffected
All versions: affected
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform 7
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform 7
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform 7
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform 7
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack
All versions: affected
All versions: unaffected
Red Hat · Red Hat Single Sign-On 7
All versions: affected
References (14)
- RHSA-2026:83082 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:83520 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:83670 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:85234 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:92408 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95221 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95466 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95504 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95505 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95887 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-89058 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2519775 (opens in a new tab)issue-trackingx_refsource_REDHAT
- https://github.com/resteasy/resteasy/commit/efeb2b7 (opens in a new tab)
- https://github.com/resteasy/resteasy/security/advisories/GHSA-972r-f3fv-whm3 (opens in a new tab)exploit
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-89058)Record last updated .