CVE-2026-81829

CVE CVE-2026-81829EUVD EUVD-2026-81617Published 2026-09-17T14:01:30.000ZLast changed 2026-09-21T17:24:19.000ZCVSS 5.3

What the advisory describes

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Red Hat — Exploit Intelligence
• Red Hat — Red Hat JBoss Enterprise Application Platform 8
• Red Hat — Red Hat JBoss Enterprise Application Platform Expansion Pack
• Red Hat — Red Hat build of Apicurio Registry 3
• Red Hat — Red Hat build of Quarkus

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Red Hat — Red Hat JBoss Enterprise Application Platform

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.