High severity7.4NVD Advisory· Published Sep 18, 2026· Updated Oct 29, 2026
CVE-2026-89058
CVE-2026-89058
Description
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
14- osv-coords12 versionspkg:rpm/almalinux/idm-pki-acmepkg:rpm/almalinux/idm-pki-basepkg:rpm/almalinux/idm-pki-capkg:rpm/almalinux/idm-pki-javapkg:rpm/almalinux/idm-pki-krapkg:rpm/almalinux/idm-pki-serverpkg:rpm/almalinux/idm-pki-toolspkg:rpm/almalinux/python3-idm-pkipkg:rpm/almalinux/pki-resteasy-corepkg:rpm/almalinux/pki-resteasy-jackson2-providerpkg:rpm/almalinux/pki-resteasy-servlet-initializerpkg:rpm/almalinux/pki-resteasy-client
< 11.9.0-6.el10_2.1.alma.1+ 11 more
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
- (no CPE)range: < 3.0.26-20.el9_8.1
- (no CPE)range: < 3.0.26-20.el9_8.1
- (no CPE)range: < 3.0.26-20.el9_8.1
- (no CPE)range: < 3.0.26-20.el9_8.1
Patches
Vulnerability mechanics
References
8- access.redhat.com/errata/RHSA-2026:83082nvd
- access.redhat.com/errata/RHSA-2026:83520nvd
- access.redhat.com/errata/RHSA-2026:85234nvd
- access.redhat.com/errata/RHSA-2026:92408nvd
- access.redhat.com/security/cve/CVE-2026-89058nvd
- bugzilla.redhat.com/show_bug.cginvd
- github.com/resteasy/resteasy/commit/efeb2b7nvd
- github.com/resteasy/resteasy/security/advisories/GHSA-972r-f3fv-whm3nvd
News mentions
0No linked articles in our index yet.