The Red Hat build of Quarkus 3.20.6.SP2 includes a fix for CVE-2026-50559, which is an authentication and authorization bypass vulnerability caused by advanced path normalization issues in the quarkus-vertx-http component. This vulnerability allows attackers to circumvent security checks by exploiting how paths are normalized, potentially granting unauthorized access. Red Hat has issued an important security advisory (RHSA-2026:26194) recommending updating to this version to mitigate the risk.

Successful exploitation of this vulnerability could allow an attacker to bypass authentication and authorization mechanisms in applications using the affected quarkus-vertx-http component, potentially leading to unauthorized access. The advisory rates the impact as important, indicating a significant security risk but does not provide a CVSS score or confirm active exploitation in the wild.

Red Hat has released an official security update in the build of Quarkus 3.20.6.SP2 that addresses this vulnerability. Users should apply this update after ensuring all previously released relevant errata are installed. Refer to Red Hat's official guidance at https://access.redhat.com/articles/11258 for update procedures. No additional mitigation steps are specified or required beyond applying the official update.