# CVE-2026-89058: Red Hat RESTEasy CORS header injection in CorsFilter

Source: https://junglewise.ai/threats/cve-2026-89058-red-hat-resteasy-cors-header-injection-in-corsfilter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89058 · Severity: high · CVSS 7.4 · Published 2026-09-18

RESTEasy is a Jakarta RESTful Web Services implementation used to build APIs and web services. When its CorsFilter is misconfigured to allow all origins ("*"), it incorrectly reflects the caller's Origin header back to the client alongside credentials-enabled settings. An attacker can exploit this by hosting a malicious website that tricks authenticated users into making requests to the vulnerable API, allowing the attacker to steal sensitive data from the victim's authenticated session.

Technologies: [Red Hat RESTEasy](https://junglewise.ai/threats/technologies/resteasy). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-89058 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89058 being exploited in the wild.

**How severe is CVE-2026-89058?** High severity, with a CVSS score of 7.4, published 18 September 2026.

**Which products and versions are affected?** Red Hat RESTEasy <UNKNOWN>.

**Is there a fix for CVE-2026-89058?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89058 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-89058?** Check whether you run Red Hat RESTEasy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a CORS (Cross-Origin Resource Sharing) header injection flaw in RESTEasy's CorsFilter component. When the filter is configured with the permissive origin policy "*", it reflects the request's Origin header directly into the Access-Control-Allow-Origin response header while also setting Access-Control-Allow-Credentials: true. This violates CORS security semantics, which prohibit the wildcard origin from being used with credentialed requests. An attacker can leverage this by crafting a malicious cross-origin request from a website under their control; the browser will allow the credentialed request due to the permissive CORS headers, enabling the attacker to read authenticated API responses. The vulnerability requires the application to explicitly enable the wildcard origin policy and make credentialed requests (cookies or auth headers included), but no user interaction beyond visiting a malicious website is needed once the user is authenticated to the target service.

## Affected products

- Red Hat RESTEasy <UNKNOWN>

## Timeline

- 2026-09-18: disclosed

## References

- [https://github.com/resteasy/resteasy](https://github.com/resteasy/resteasy)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)

## Related threats

- [RESTEasy default exception mapper information disclosure](https://junglewise.ai/threats/cve-2026-120971-resteasy-s-default-exception-mapper-returns-an-exception-s)
- [Red Hat RESTEasy denial of service in IIOImageProvider](https://junglewise.ai/threats/cve-2026-89059-red-hat-resteasy-denial-of-service-in-iioimageprovider)
- [Red Hat RESTEasy XML External Entity injection in SourceProvider](https://junglewise.ai/threats/cve-2026-17615-red-hat-resteasy-xml-external-entity-injection-in-sourceprovider)