CVE-2026-12992
Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation
CVSS Score
7.4
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).
| CWE | CWE-918 |
| Vendor | red hat |
| Product | red hat build of apicurio registry 3.3.1 |
| Published | Jun 25, 2026 |
| Last Updated | Aug 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat build of apicurio registry 3.3.1
Be the first to know when new high vulnerabilities affecting red hat red hat build of apicurio registry 3.3.1 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
Red Hat / Red Hat build of Apicurio Registry 3.3.1
All versions affected Red Hat / Red Hat build of Apicurio Registry 3.3.1
All versions affected References
access.redhat.com: https://access.redhat.com/errata/RHSA-2026:59360 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-12992 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2491691 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12992.json