CVE-2026-12992
Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).
- Record
CVE-2026-12992- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-918, CWE-918
- Updated
- 2026-11-05
EUVDEUVD-2026-39577
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).
- Record
EUVD-2026-39577- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-rcmh-vfq7-8gf4
Apicurio Registry allows upload of WSDL raising HTTP request
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).
- Record
GHSA-rcmh-vfq7-8gf4- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-918
- Updated
- 2026-11-04
NVD
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).
- Record
CVE-2026-12992- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVGHSA-rcmh-vfq7-8gf4
Apicurio Registry allows upload of WSDL raising HTTP request
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).
- Record
GHSA-rcmh-vfq7-8gf4- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-918
- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.apicurio:apicurio-registry-schema-util-wsdlMaven |
3.3.0 up to 3.3.1 | 3.3.1 |
io.apicurio:apicurio-registry-schema-util-wsdlMaven |
before 3.2.6 | 3.2.6 |
io.apicurio:apicurio-registry-schema-util-wsdlMaven |
before 3.2.6, plus listed versions 2.1.4.Final2.1.5.Final2.2.0.Final2.2.1.Final2.2.2.Final Show 45 moreShow less2.2.3.Final2.2.4.Final2.2.5.Final2.3.0.Final2.3.1.Final2.4.0.Final2.4.1.Final2.4.10.Final2.4.11.Final2.4.12.Final2.4.13.Final2.4.14.Final2.4.2.Final2.4.3.Final2.4.4.Final2.4.5.Final2.4.6.Final2.4.7.Final2.4.8.Final2.4.9.Final2.5.0.Final2.5.1.Final2.5.10.Final2.5.11.Final2.5.2.Final2.5.3.Final2.5.5.Final2.5.6.Final2.5.7.Final2.5.8.Final2.5.9.Final2.6.0.Final2.6.1.Final2.6.11.Final2.6.12.Final2.6.13.Final2.6.2.Final2.6.3.Final2.6.4.Final2.6.5.Final2.6.6.Final2.6.7.Final2.6.8.Final2.6.9.Final3.0.0 |
3.2.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, references | OSV | |
| affected, facts, references | GitHub Advisories | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-12992 is a high vulnerability (CVSS 7.4) in Red Hat Build Of Apicurio Registry 3.3.1, published June 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in io.apicurio:apicurio-registry-schema-util-wsdl 3.3.1.
References
access.redhat.com/errata/RHSA-2026:59360
bugzilla.redhat.com/show_bug.cgi?id=2491691
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12992.json
nvd.nist.gov/vuln/detail/CVE-2026-12992
github.com/Apicurio/apicurio-registry/issues/8188
Show 7 moreShow less
Left out here: 34 versions. The JSON record has them.