---
id: CVE-2026-89058
title: >-
  A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all
  origins ("*"), reflects the request's Origin header back in the
  Access-Control-Allow-Origin response together with
  Access-Control-Allow-Credentials: true
summary: >-
  A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all
  origins ("*"), reflects the request's Origin header back in the
  Access-Control-Allow-Origin response together with
  Access-Control-Allow-Credentials: true. Thi…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N'
cwe:
  - CWE-346
  - CWE-942
vendor: Red Hat
product: RESTEasy
affected:
  - RESTEasy < 6.2.19.Final
  - RESTEasy >= 7.0.0.Alpha1 < 7.0.5.Final
  - org.jboss.resteasy/resteasy-core (all versions)
  - resteasy-core (all versions)
  - resteasy-core (all versions)
  - resteasy-core (all versions)
  - resteasy-core (all versions)
  - rhbk/keycloak-rhel9-operator (all versions)
  - 'redhat-pki:10/redhat-pki (all versions)'
  - redhat-pki (all versions)
  - dogtag-pki (all versions)
  - 'pki-core:10.6/pki-core'
  - jackson-jaxrs-providers
  - pki-core
  - resteasy (all versions)
  - resteasy-core (all versions)
  - resteasy-jaxrs (all versions)
  - jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 (all versions)
  - jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)
  - jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)
  - resteasy-jaxrs (all versions)
  - resteasy-core (all versions)
  - resteasy-core (all versions)
  - candlepin
  - resteasy-jaxrs (all versions)
published: '2026-09-18'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:47.680'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89058'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:83082'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89058'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2519775'
    label: secalert@redhat.com
  - url: 'https://github.com/resteasy/resteasy/commit/efeb2b7'
    label: secalert@redhat.com
  - url: >-
      https://github.com/resteasy/resteasy/security/advisories/GHSA-972r-f3fv-whm3
    label: secalert@redhat.com
  - url: >-
      https://github.com/resteasy/resteasy/security/advisories/GHSA-972r-f3fv-whm3
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89058.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89058'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89058'
  - url: 'https://access.redhat.com/errata/RHSA-2026:83520'
    label: 'RHSA-2026:83520'
  - url: 'https://access.redhat.com/errata/RHSA-2026:85234'
    label: 'RHSA-2026:85234'
  - url: 'https://access.redhat.com/errata/RHSA-2026:92408'
    label: 'RHSA-2026:92408'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T11:59:37.120915Z'
epss: 0.00258
epssPercentile: 0.17368
ingestedAt: '2026-09-18T07:37:23.436Z'
---

## Overview

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat Build of Keycloak, Red Hat build of Quarkus, Red Hat Certificate System 10, … · no fix planned: Red Hat build of Apicurio Registry 3, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, … · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89058.json)