CVE-2026-50559 affects the quarkus-vertx-http component in Red Hat build of Quarkus 3.20.6.SP2 and involves an authentication and authorization bypass via advanced path normalization vulnerabilities. This allows attackers to bypass security controls by exploiting how HTTP paths are normalized, potentially granting unauthorized access. The issue is addressed in the Red Hat security advisory RHSA-2026:26194, which provides an update for the affected product. The vulnerability is rated as important by Red Hat Product Security and has a CVSS vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

The vulnerability allows an attacker to bypass authentication and authorization controls in the quarkus-vertx-http component, potentially leading to unauthorized access to protected resources. The confidentiality of the system is impacted, but integrity and availability are not affected. This could compromise sensitive information if exploited.

Red Hat has released an update for Red Hat build of Quarkus 3.20.6.SP2 that fixes this vulnerability. Users should apply this security update after ensuring all previously released relevant errata are applied. Refer to Red Hat's official guidance at https://access.redhat.com/articles/11258 for update instructions. No additional mitigation steps are indicated by the vendor advisory.