← Back

CVE-2026-12992

nvd nist
Published: Jun 25, 2026Modified: Jul 15, 2026

JSON object

Loading...
7.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Exploitability: 3.1 / Impact: 3.7
Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).

Affected (1)

Redhat
1 product
Build Of Apicurio Registry
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Build Of Apicurio Registry
From 3.0 to 3.2

Related CWEs

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (5)

Source: secalert@redhat.com
Vendor Advisory
Source: secalert@redhat.com
Issue TrackingVendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Vendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Issue TrackingVendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Vendor Advisory

Timeline

No history available yet.