CVE-2026-39852

High

Advisory

Published 4 May 2026In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.005; 40th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 43; of 17,781 indexed, latest versions
Container images: 35; deployed by those charts
Fix available: 1 of 1; affected package

Quarkus has Authentication/Authorization bypasses

Carried by container images the latest versions of 43 of 17,781 indexed charts deploy, on 35 images.

Affected package	Affected versions	Fixed in	Images
quarkus-vertx-httpmaven	1.9.0.Final, 1.13.2.Final, 2.4.2.Final, 2.12.3.Final+20 more	3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1	35

OSV records: GHSA-rc95-pcm8-65v9

Charts affected

43 by stars

Chart

Latest

Affected images

Radar Score

apicurio-registryapicurio-registry-helm

3.8.0

2 of 2 See more

apicurio-registry apicurio-registry-helm 3.8.0

2 of the 2 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/apicurio/apicurio-registry-kube-sync :1.0.1	70ef31840269	quarkus-vertx-http@2.4.2.Final	3.20.6.1
quay.io/apicurio/apicurio-registry-mem :2.5.8.Final	3b036692d546	quarkus-vertx-http@3.2.8.Final	3.20.6.1

Open the chart page →

6,675

keycloak-operatorkeycloak-operator

0.0.4

1 of 1 See more

keycloak-operator keycloak-operator 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak-operator :20.0.2	b1710745fa64	quarkus-vertx-http@2.13.3.Final	3.20.6.1

Open the chart page →

4,652

musicocielmusicociel

0.0.0

1 of 3 See more

musicociel musicociel 0.0.0

1 of the 3 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :23.0.3	4f72a5b0c076	quarkus-vertx-http@3.2.9.Final	3.20.6.1

Open the chart page →

4,406

cosmocosmo-platform

0.20.0

1 of 10 See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
ghcr.io/wundergraph/cosmo/keycloak :0.13.0	b37408461b9b	quarkus-vertx-http@3.27.2	3.27.3.1

Open the chart page →

28,839

clowder2ncsa

1.9.7

1 of 12 See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
bitnamilegacy/keycloak :20.0.5	cb04e49e6eb1	quarkus-vertx-http@2.13.7.Final	3.20.6.1

Open the chart page →

37,373

arlas-aiasarlas-stack

28.8.0

1 of 22 See more

arlas-aias arlas-stack 28.8.0

1 of the 22 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
bitnamilegacy/keycloak :26.3.3-debian-12-r0	da3df0976a9f	quarkus-vertx-http@3.20.2.1	3.20.6.1

Open the chart page →

40,238

keycloakbarravar

1.0.4

1 of 1 See more

keycloak barravar 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :24.0.3	4d6f22991266	quarkus-vertx-http@3.8.3	3.20.6.1

Open the chart page →

2,381

custom-rhcl-consolecustom-rhcl-console

0.1.2

1 of 3 See more

custom-rhcl-console custom-rhcl-console 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/custom-rhcl-console :dns-prober-v0.1.2	1a592ee6651a	quarkus-vertx-http@3.34.6	3.35.1.1

Open the chart page →

1,885

damap-chartdamap

0.3.0

2 of 5 See more

damap-chart damap 0.3.0

2 of the 5 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
ghcr.io/damap-org/damap-backend :5.0.0	f3d0c7d35498	quarkus-vertx-http@3.11.1	3.20.6.1
quay.io/keycloak/keycloak :26.4	9409c59bdfb6	quarkus-vertx-http@3.27.1	3.27.3.1

Open the chart page →

13,936

drogue-cloud-coredrogue-iot

0.7.11

1 of 22 See more

drogue-cloud-core drogue-iot 0.7.11

1 of the 22 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0	054ef67eb7da	quarkus-vertx-http@2.13.7.Final	3.20.6.1

Open the chart page →

55,666

drogue-cloud-twindrogue-iot

0.7.11

1 of 8 See more

drogue-cloud-twin drogue-iot 0.7.11

1 of the 8 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0	054ef67eb7da	quarkus-vertx-http@2.13.7.Final	3.20.6.1

Open the chart page →

6,915

eoloPlanteolo-planner

0.1.0

1 of 7 See more

eoloPlant eolo-planner 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
mastercloudapps/server :v2.23	f3d24dfe2686	quarkus-vertx-http@2.14.3.Final	3.20.6.1

Open the chart page →

27,537

eoloplannereoloplanner

0.1.0

1 of 7 See more

eoloplanner eoloplanner 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
codeurjc/server :v1.0	310bea5b1ee7	quarkus-vertx-http@2.14.3.Final	3.20.6.1

Open the chart page →

32,205

eoloPlannerCommunicationsKubernetes3eoloplannercommunicationskuberneteshelm

0.1.0

1 of 7 See more

eoloPlannerCommunicationsKubernetes3 eoloplannercommunicationskuberneteshelm 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
mastercloudapps/server :v2.23	f3d24dfe2686	quarkus-vertx-http@2.14.3.Final	3.20.6.1

Open the chart page →

27,537

eoloplannereoloplanner-molynx-gat

0.1.0

1 of 7 See more

eoloplanner eoloplanner-molynx-gat 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
codeurjc/server :v1.0	310bea5b1ee7	quarkus-vertx-http@2.14.3.Final	3.20.6.1

Open the chart page →

28,482

eoloplanteoloplant

1.0.0

1 of 7 See more

eoloplant eoloplant 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
mastercloudapps/server :v2.23	f3d24dfe2686	quarkus-vertx-http@2.14.3.Final	3.20.6.1

Open the chart page →

27,537

eoloplantseoloplants-urjc

0.1.0

1 of 7 See more

eoloplants eoloplants-urjc 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
codeurjc/server :v1.0	310bea5b1ee7	quarkus-vertx-http@2.14.3.Final	3.20.6.1

Open the chart page →

27,721

servereoloserver

0.1.0

1 of 7 See more

server eoloserver 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
codeurjc/server :v1.0	310bea5b1ee7	quarkus-vertx-http@2.14.3.Final	3.20.6.1

Open the chart page →

32,205

eoloplanthttpd-eoloplant

0.1.0

1 of 7 See more

eoloplant httpd-eoloplant 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
codeurjc/server :v1.0	310bea5b1ee7	quarkus-vertx-http@2.14.3.Final	3.20.6.1

Open the chart page →

32,205

eoloserverihuertas2021-vmartinp2021-helm

0.1.0

1 of 7 See more

eoloserver ihuertas2021-vmartinp2021-helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
codeurjc/server :v1.0	310bea5b1ee7	quarkus-vertx-http@2.14.3.Final	3.20.6.1

Open the chart page →

27,721

opencloudjacobcolvin

0.2.3

1 of 13 See more

opencloud jacobcolvin 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.1.4	044a457e0498	quarkus-vertx-http@3.15.3.1	3.20.6.1

Open the chart page →

45,239

miot-calendarmicroboxlabs

0.1.0

1 of 1 See more

miot-calendar microboxlabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
ghcr.io/microboxlabs/miot-calendar :latest-jvm	7157cdc0bf5b	quarkus-vertx-http@3.31.1	3.33.1.1

Open the chart page →

1,937

microcks-operatormicrocks

0.0.11

1 of 1 See more

microcks-operator microcks 0.0.11

1 of the 1 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/microcks/microcks-operator :0.0.11	96d1054d4a61	quarkus-vertx-http@3.27.1	3.27.3.1

Open the chart page →

1,261

commafeedmt190502

8.2.0

1 of 3 See more

commafeed mt190502 8.2.0

1 of the 3 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
athou/commafeed :6.2.0-postgresql	5e388351df1a	quarkus-vertx-http@3.31.2	3.33.1.1

Open the chart page →

3,687

keycloakmt190502

1.4.6

1 of 3 See more

keycloak mt190502 1.4.6

1 of the 3 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.5.6	8d44614c7479	quarkus-vertx-http@3.27.2	3.27.3.1

Open the chart page →

2,901

my-app-namemy-app-name

0.0.2

1 of 1 See more

my-app-name my-app-name 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
viniciusfcf/gitops-quarkus-app-jvm :latest	bba8ee1b5cd5	quarkus-vertx-http@2.12.3.Final	3.20.6.1

Open the chart page →

9,149

Practica_4_helmmy-heml-app

0.1.0

1 of 7 See more

Practica_4_helm my-heml-app 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
codeurjc/server :v1.0	310bea5b1ee7	quarkus-vertx-http@2.14.3.Final	3.20.6.1

Open the chart page →

27,721

incorencsa

1.38.0

1 of 29 See more

incore ncsa 1.38.0

1 of the 29 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
bitnamilegacy/keycloak :24.0.4	cc599cbd15ff	quarkus-vertx-http@3.8.4	3.20.6.1

Open the chart page →

15,369

apicurioone-acre-fund

2.3.0

3 of 5 See more

apicurio one-acre-fund 2.3.0

3 of the 5 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
apicurio/apicurio-studio-api :0.2.62.Final	302d202ed149	quarkus-vertx-http@2.16.4.Final	3.20.6.1
apicurio/apicurio-studio-ui :0.2.62.Final	349c845270c2	quarkus-vertx-http@2.16.4.Final	3.20.6.1
apicurio/apicurio-studio-ws :0.2.62.Final	27a91978a388	quarkus-vertx-http@2.16.4.Final	3.20.6.1

Open the chart page →

18,667

p4p4

0.1.0

1 of 7 See more

p4 p4 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
mastercloudapps/server :v2.23	f3d24dfe2686	quarkus-vertx-http@2.14.3.Final	3.20.6.1

Open the chart page →

27,537

keycloakpascaliske

0.2.0

1 of 1 See more

keycloak pascaliske 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.0.7	4388e2379b7e	quarkus-vertx-http@3.15.1	3.20.6.1

Open the chart page →

2,097

Practica_4_helmpr04helm

0.1.0

1 of 7 See more

Practica_4_helm pr04helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
codeurjc/server :v1.0	310bea5b1ee7	quarkus-vertx-http@2.14.3.Final	3.20.6.1

Open the chart page →

27,558

rada-platformrada-platform

0.1.0

1 of 7 See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
ghcr.io/projectnessie/nessie :0.92.1	9efe3c74d55f	quarkus-vertx-http@3.12.2	3.20.6.1

Open the chart page →

21,211

keycloaksb-helm-charts

0.3.0

1 of 2 See more

keycloak sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.0.6	a93d22e13b86	quarkus-vertx-http@3.15.1	3.20.6.1

Open the chart page →

2,590

showroom-docs-mcpshowroom-docs-mcp

2.1.0

1 of 4 See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/showroom-docs-mcp :latest	1a6eff92827a	quarkus-vertx-http@3.27.3	3.27.3.1

Open the chart page →

5,201

keycloaksikalabs

0.1.0

1 of 1 See more

keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.3.3	6a7217a100bd	quarkus-vertx-http@3.20.2.1	3.20.6.1

Open the chart page →

1,690

simple-keycloaksikalabs

0.1.0

1 of 1 See more

simple-keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	quarkus-vertx-http@2.13.3.Final	3.20.6.1

Open the chart page →

6,443

wonder-mesh-netstrrl-helm

2026.629.0

1 of 3 See more

wonder-mesh-net strrl-helm 2026.629.0

1 of the 3 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.0	09a381c715ab	quarkus-vertx-http@3.15.1	3.20.6.1

Open the chart page →

5,063

hermestouk

0.6.0

1 of 3 See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	quarkus-vertx-http@1.13.2.Final	3.20.6.1

Open the chart page →

12,455

opencloudunxwares

0.2.3

1 of 13 See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.1.4	044a457e0498	quarkus-vertx-http@3.15.3.1	3.20.6.1

Open the chart page →

45,239

keycloakwiremind

25.3.1

1 of 2 See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
ghcr.io/wiremind/bitnami/keycloak :26.5.0-debian-12-r3	8622ea9e43c0	quarkus-vertx-http@3.27.1	3.27.3.1

Open the chart page →

7,624

apicurio-registry-sqlwitcom-gmbh

0.1.0

1 of 1 See more

apicurio-registry-sql witcom-gmbh 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
apicurio/apicurio-registry-jpa :1.3.2.Final	44eeddd3562c	quarkus-vertx-http@1.9.0.Final	3.20.6.1

Open the chart page →

3,424

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-39852.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	quarkus-vertx-http@2.13.6.Final	3.20.6.1

Open the chart page →

6,016

Container images carrying it

35 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
codeurjc/server :v1.0	310bea5b1ee7	quarkus-vertx-http@2.14.3.Final	3.20.6.1	8
mastercloudapps/server :v2.23	f3d24dfe2686	quarkus-vertx-http@2.14.3.Final	3.20.6.1	4
quay.io/keycloak/keycloak :26.1.4	044a457e0498	quarkus-vertx-http@3.15.3.1	3.20.6.1	2
quay.io/keycloak/keycloak :20.0	054ef67eb7da	quarkus-vertx-http@2.13.7.Final	3.20.6.1	2
apicurio/apicurio-registry-jpa :1.3.2.Final	44eeddd3562c	quarkus-vertx-http@1.9.0.Final	3.20.6.1	1
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	quarkus-vertx-http@1.13.2.Final	3.20.6.1	1
apicurio/apicurio-studio-api :0.2.62.Final	302d202ed149	quarkus-vertx-http@2.16.4.Final	3.20.6.1	1
apicurio/apicurio-studio-ui :0.2.62.Final	349c845270c2	quarkus-vertx-http@2.16.4.Final	3.20.6.1	1
apicurio/apicurio-studio-ws :0.2.62.Final	27a91978a388	quarkus-vertx-http@2.16.4.Final	3.20.6.1	1
athou/commafeed :6.2.0-postgresql	5e388351df1a	quarkus-vertx-http@3.31.2	3.33.1.1	1
bitnamilegacy/keycloak :20.0.5	cb04e49e6eb1	quarkus-vertx-http@2.13.7.Final	3.20.6.1	1
bitnamilegacy/keycloak :24.0.4	cc599cbd15ff	quarkus-vertx-http@3.8.4	3.20.6.1	1
bitnamilegacy/keycloak :26.3.3-debian-12-r0	da3df0976a9f	quarkus-vertx-http@3.20.2.1	3.20.6.1	1
viniciusfcf/gitops-quarkus-app-jvm :latest	bba8ee1b5cd5	quarkus-vertx-http@2.12.3.Final	3.20.6.1	1
ghcr.io/damap-org/damap-backend :5.0.0	f3d0c7d35498	quarkus-vertx-http@3.11.1	3.20.6.1	1
ghcr.io/microboxlabs/miot-calendar :latest-jvm	7157cdc0bf5b	quarkus-vertx-http@3.31.1	3.33.1.1	1
ghcr.io/projectnessie/nessie :0.92.1	9efe3c74d55f	quarkus-vertx-http@3.12.2	3.20.6.1	1
ghcr.io/wiremind/bitnami/keycloak :26.5.0-debian-12-r3	8622ea9e43c0	quarkus-vertx-http@3.27.1	3.27.3.1	1
ghcr.io/wundergraph/cosmo/keycloak :0.13.0	b37408461b9b	quarkus-vertx-http@3.27.2	3.27.3.1	1
quay.io/apicurio/apicurio-registry-kube-sync :1.0.1	70ef31840269	quarkus-vertx-http@2.4.2.Final	3.20.6.1	1
quay.io/apicurio/apicurio-registry-mem :2.5.8.Final	3b036692d546	quarkus-vertx-http@3.2.8.Final	3.20.6.1	1
quay.io/keycloak/keycloak :26.0	09a381c715ab	quarkus-vertx-http@3.15.1	3.20.6.1	1
quay.io/keycloak/keycloak :26.0.7	4388e2379b7e	quarkus-vertx-http@3.15.1	3.20.6.1	1
quay.io/keycloak/keycloak :24.0.3	4d6f22991266	quarkus-vertx-http@3.8.3	3.20.6.1	1
quay.io/keycloak/keycloak :23.0.3	4f72a5b0c076	quarkus-vertx-http@3.2.9.Final	3.20.6.1	1
quay.io/keycloak/keycloak :26.3.3	6a7217a100bd	quarkus-vertx-http@3.20.2.1	3.20.6.1	1
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	quarkus-vertx-http@2.13.3.Final	3.20.6.1	1
quay.io/keycloak/keycloak :26.5.6	8d44614c7479	quarkus-vertx-http@3.27.2	3.27.3.1	1
quay.io/keycloak/keycloak :26.4	9409c59bdfb6	quarkus-vertx-http@3.27.1	3.27.3.1	1
quay.io/keycloak/keycloak :26.0.6	a93d22e13b86	quarkus-vertx-http@3.15.1	3.20.6.1	1
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	quarkus-vertx-http@2.13.6.Final	3.20.6.1	1
quay.io/keycloak/keycloak-operator :20.0.2	b1710745fa64	quarkus-vertx-http@2.13.3.Final	3.20.6.1	1
quay.io/maximilianopizarro/custom-rhcl-console :dns-prober-v0.1.2	1a592ee6651a	quarkus-vertx-http@3.34.6	3.35.1.1	1
quay.io/maximilianopizarro/showroom-docs-mcp :latest	1a6eff92827a	quarkus-vertx-http@3.27.3	3.27.3.1	1
quay.io/microcks/microcks-operator :0.0.11	96d1054d4a61	quarkus-vertx-http@3.27.1	3.27.3.1	1