CVE-2026-89058General

LOWCVSS 7.4 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-346CWE-942

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 1 signal
General: 1 classified signal
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-09-22); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

General

150.0%

Disclosure

150.0%

Classification over time

Date	Total	Labels

2026-09-22	1	General1
2026-10-19	1	Disclosure1

Full discourse2 posts

Ariel Carralbal@ArielCarralbal19d
Disclosure
⚠️ Fuera de Panache y Qute: el CorsFilter de RESTEasy configurado con origen "*" refleja el Origin junto con credenciales (CVE-2026-89058), y Hibernate Validator permite un DoS sin autenticación (CVE-2026-93879, Moderate).
Post summary
The text discloses two CVEs (CVE-2026-89058 and CVE-2026-93879) with technical descriptions — a CORS misconfiguration in RESTEasy and an unauthenticated DoS in Hibernate Validator — but does not mention any PoC, exploit tool, active exploitation, or remediation steps.
2000018
59 followersView on X
ExploitGrid@exploitgrid46d
General
Real example: CVE-2026-89058 | CVSS 7.4 (HIGH) Composite Score: 29.6/100 (MONITOR) No public exploit. Low EPSS. The math tells you what the severity label cannot: this is not urgent right now.
Post summary
The tweet announces CVE-2026-89058 with CVSS 7.4 and a composite monitor rating, explicitly stating no public exploit and low urgency, but provides no technical vulnerability details, exploit code, patches, or evidence of active wild exploitation.
1000031
202 followersView on X

Explore more

Back to dashboard