7.4 High

CVE-2026-12992 Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation

Description

A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector: Network
Attack complexity: Low
Privileges required: Low
Interaction: None
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: Low

Affected products and versions

Product	Affected versions	Fixed in
Red Hat build of Apicurio Registry 3	Versions not published
Red Hat build of Apicurio Registry 3.3.1	Versions not published

References

RHSA-2026:59360 access.redhat.com
access.redhat.com access.redhat.com
RHBZ#2491691 bugzilla.redhat.com

Timeline

Published June 25, 2026
Last modified November 5, 2026

The 78 CVEs of Red Hat build of Apicurio Registry 3 →

CVE-2026-107912 Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw 7.7 High CVE-2026-120971 A flaw was found in RESTEasy's default exception mapper 5.3 Medium CVE-2026-94449 Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service 7.5 High CVE-2026-93562 A flaw was found in Netty's HTTP/1 decoder 6.5 Medium

Track this CVE