CVE-2026-110737 (Vaadin push endpoint CORS): will there be a fix for Jmix 2.8.x

Support
1

Hello Jmix Support Team,

We’re using Jmix 2.8.x and noticed this advisory: CVE-2026-110737: Push endpoint returns permissive CORS headers

From above link, here is Vulnerability Breakdown:

  • The Issue: The server push endpoint reflects the incoming request’s Origin header into permissive CORS headers.

  • Severity: Low (CVSS score of 2.3).

  • Exposure Condition: Your application must have server push enabled (via @Push or related configurations). If your Jmix app does not use server push, it is not vulnerable.

From the breakdown, our application is impacted. Therefore, we’d like to know how to handle it before we go live.

  1. Will Jmix release a patch for 2.8.x?
  2. If not, what is the recommended solution or workaround?

Best Regards.
Syauqi Hafizuddin