High severity7.4NVD Advisory· Published Jun 25, 2026· Updated Jul 15, 2026
CVE-2026-12992
CVE-2026-12992
Description
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).
Affected products
3- cpe:2.3:a:redhat:build_of_apicurio_registry:*:*:*:*:*:*:*:*Range: >=3.0,<=3.2
Patches
Vulnerability mechanics
References
3- access.redhat.com/security/cve/CVE-2026-12992nvdVendor Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingVendor Advisory
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12992.jsonnvdVendor Advisory
News mentions
0No linked articles in our index yet.