CVE-2026-89058 is a vulnerability in RESTEasy's CorsFilter component. When the CorsFilter is configured with a wildcard origin ("*"), it reflects the Origin header from incoming requests back in the Access-Control-Allow-Origin response header while also setting Access-Control-Allow-Credentials to true. This combination violates CORS security policies by allowing credentialed cross-origin requests from arbitrary origins, which can lead to unauthorized disclosure of sensitive information from authenticated sessions. The vulnerability affects specific versions of RESTEasy as listed, and has a CVSS 3.1 base score of 7.4 indicating a medium severity. Red Hat has acknowledged the issue and provided advisories but no explicit patch links were included in the input data.

The vulnerability allows an attacker controlling a malicious website to bypass same-origin policy restrictions by making credentialed cross-origin requests and reading sensitive authenticated responses from a victim's browser session. This results in a loss of confidentiality of the victim's data accessible via RESTEasy services configured with the vulnerable CorsFilter settings.

No explicit patch or fix status is provided in the vendor advisory content. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid configuring RESTEasy's CorsFilter with a wildcard origin ("*") combined with Access-Control-Allow-Credentials: true. Restrict CORS origins to trusted domains to prevent exploitation.