CVE-2023-6394

criticalpriority · track · 36OT risk · elevatedEPSS 0.008 · 57 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.81% (57th) EPSS

CVSS 9.1 · critical

Is it mine?

8 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-26

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.4–9.1

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 5.2

v3.17.4highAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · secalert@redhat.com USexploitability 2.2 · impact 5.2

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-551USCWE-696USCWE-696USCWE-862USCWE-862USCWE-862US

affected products (8)

Products and version ranges known to be affected.

Red Hat Red Hat build of Quarkus 2.13.9.Final< 2.13.9.Final-redhat-00002enisa_euvdEU
Red Hat Red Hat build of Quarkus 3.2.9.Final< 3.2.9.Final-redhat-00002enisa_euvdEU
Red Hat Inc. Red Hat build of Quarkusall versionsfstec_bduRU
Сообщество свободного программного обеспечения quarkus2.14.0 → 3.5.3fstec_bduRU
quarkus quarkus< 3.6.0nvdUScpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*
redhat build of quarkusall versionsnvdUScpe:2.3:a:redhat:build_of_quarkus:*:*:*:*:*:*:*:*
Maven io.quarkus:quarkus-smallrye-graphql-client< 2.13.9.FinalosvUSpkg:maven/io.quarkus/quarkus-smallrye-graphql-client
Maven io.quarkus:quarkus-smallrye-graphql-client2.14.0 → 3.5.3osvUSpkg:maven/io.quarkus/quarkus-smallrye-graphql-client

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-mvc8-6ffp-jrx5Authorization bypass in Quarkus2023-12-09ghsa · osvUS
A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd osv NVD CVE.org MITRE

published 2023-12-09modified 2026-10-20

references (13)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan