The vulnerability arises because Quarkus captures local environment variables from the quarkus.* namespace during application build, embedding these values into the resulting application. If sensitive environment variables used for testing or development (e.g., database drop commands or trusting all TLS certificates) are set locally or in CI environments, they become part of the built application and may lead to dangerous behavior if not overridden at runtime. This behavior is limited to quarkus.* configuration properties and does not affect application-specific properties. The vulnerability affects Quarkus versions 3.2.12 and 3.8.4 as explicitly stated. Red Hat advisories confirm the issue and provide updates to address it.

Sensitive configuration data set in environment variables during build time can be leaked into the built Quarkus application, potentially exposing dangerous or unintended behavior such as dropping databases or trusting self-signed TLS certificates. This can lead to confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:H/I:H/A:H). The vulnerability is limited to quarkus.* namespace properties and does not affect other application-specific configurations.

Red Hat has released security updates for the affected versions of Quarkus (notably 3.8.4) that address this vulnerability. Users should apply these official patches as provided in the Red Hat advisories (e.g., RHSA-2024:2106). Before applying updates, ensure all previously released errata relevant to the system are applied. There is no indication that no action is required or that the issue is already mitigated without patching. Therefore, upgrading to the fixed versions is the recommended mitigation.