Quarkus Data Panache CVE-2026-94451

Exploitation requires the target application to use Quarkus REST Data Panache and to expose an auto-generated REST endpoint that accepts a user-supplied sort/ordering parameter which is not restricted to an allow-list of permitted entity fields. The limiting factor is deployment-specific: the vulnerability is only reachable if developers have enabled these generated endpoints and exposed them to the attacker's network, and real impact depends on whether those endpoints are unauthenticated and on the underlying data model and database. Where endpoints are internal-only or protected by authentication/authorization, the practical risk is substantially reduced despite the PR:N rating.

This is a moderate-severity input-validation flaw (CWE-20) in Quarkus REST Data Panache, which auto-generates REST endpoints for data entities. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, base 6.5) indicates a network-reachable, low-complexity, unauthenticated issue with limited confidentiality impact (information the attacker should not access) and limited availability impact (database slowdown/DoS). No EPSS score, CISA KEV listing, SSVC decision data, or POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - exploitation status is therefore based solely on the vendor advisory describing the flaw, not on observed attacks. The real-world priority is tempered by a key limiting factor the CVSS vector does not capture: exploitation requires that the application actually exposes the auto-generated Panache REST endpoints (and specifically endpoints accepting a user-controlled sort parameter), which is a developer/deployment choice rather than a default-on service. Treat this as a genuine but not emergency issue: patch in routine cycles, prioritizing internet-facing Quarkus services that expose Panache-generated endpoints. Note that PR:N in the vector reflects the framework default of unauthenticated generated endpoints, but whether a given deployment is actually unauthenticated depends on the application - verify per deployment.

An attacker who can reach a Quarkus application exposing an auto-generated REST Data Panache endpoint sends a request with a crafted sort parameter that is not validated against an allow-list of entity fields. By referencing fields or relations they should not see, they infer or disclose otherwise-restricted data through ordering behavior, or by forcing expensive sort/join operations they drive the database into heavy processing, degrading or denying service. No public exploit code was identified in the provided data, and the attack is low-complexity and requires no user interaction per the CVSS vector.