Executive brief
Quarkus is a Java framework commonly used to build cloud-native applications that process templates to generate dynamic web pages and emails. A vulnerability in the Qute template engine allows attackers who can control template content to bypass security restrictions and execute arbitrary commands on the server, potentially leading to full system compromise.
Technical details
The vulnerability exists in Qute's ReflectionValueResolver component, which processes template expressions but fails to properly restrict access to sensitive Java internal APIs when handling certain data types such as Enums. An attacker with the ability to influence or provide template text can exploit this access control bypass to invoke unauthorized methods and achieve remote code execution. The vulnerability requires template text under attacker control but does not require prior authentication. A patch is expected to restrict reflection-based access to privileged Java APIs during template evaluation.
Affected products
- Red Hat Quarkus <unknown>
Timeline
- 2026-08-31: disclosed
- 2026-08-31: advisory