CVE-2026-89058: Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config
Vulnerability summary
CVE-2026-89058 is a high (CVSS 7.4) Origin Validation Error vulnerability in resteasy3.0. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 18.3% of scored vulnerabilities.
Not severe (CVSS 7.4, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 18-09-2026PublishedVulnerability first disclosed.
- 29-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
- NVDNIST7.4HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
18%
Versus all other CVEs
30-day change
Decrease -0.21 pp
From 0.47% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-346Origin Validation ErrorThe product does not properly verify that the source of data or communication is valid.
- CWE-942Permissive Cross-domain Security Policy with Untrusted DomainsThe product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu2 products
- resteasyAll versions (No fix recorded)
- resteasy3.0All versions (No fix recorded)
Debian1 product
- resteasy3.0All versions (No fix recorded)
2 vendors · 3 products
