CVE-2026-12992

A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:59360
https://access.redhat.com/security/cve/CVE-2026-12992	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2491691	Issue Tracking Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:59360
https://access.redhat.com/security/cve/CVE-2026-12992	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2491691	Issue Tracking Vendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12992.json	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:build_of_apicurio_registry:*:*:*:*:*:*:*:*

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Se encontró un fallo en Apicurio Registry. El WSDLReaderAccessor crea un WSDLReader de wsdl4j sin deshabilitar la característica javax.wsdl.importDocuments. Cuando la regla VALIDITY está configurada en FULL, un atacante con acceso de rol de Desarrollador puede cargar un documento WSDL que contenga ubicaciones de importación controladas por el atacante, lo que hace que el registro emita peticiones HTTP a URLs internas arbitrarias (falsificación de petición del lado del servidor).

Information

Published : 2026-06-25 22:17

Updated : 2026-10-25 22:10

NVD link : CVE-2026-12992

Mitre link : CVE-2026-12992

CVE.ORG link : CVE-2026-12992

JSON object : View

Products Affected

redhat

build_of_apicurio_registry

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-12992", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12992", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T21:35:41.868366Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.1}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "packageName": "apicurio/apicurio-registry-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "packageName": "apicurio/apicurio-registry-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "versions": [{"status": "unaffected", "version": "registry-rhel8", "lessThan": "*", "versionType": "rpm"}, {"status": "unaffected", "version": "registry-rhel9", "lessThan": "*", "versionType": "rpm"}], "packageName": "apicurio/apicurio", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-06-25T22:17:00.760", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59360", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-12992", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491691", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59360", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-12992", "tags": ["Vendor Advisory"], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491691", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12992.json", "tags": ["Vendor Advisory"], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-918"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery)."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en Apicurio Registry. El WSDLReaderAccessor crea un WSDLReader de wsdl4j sin deshabilitar la caracter\u00edstica javax.wsdl.importDocuments. Cuando la regla VALIDITY est\u00e1 configurada en FULL, un atacante con acceso de rol de Desarrollador puede cargar un documento WSDL que contenga ubicaciones de importaci\u00f3n controladas por el atacante, lo que hace que el registro emita peticiones HTTP a URLs internas arbitrarias (falsificaci\u00f3n de petici\u00f3n del lado del servidor)."}], "lastModified": "2026-10-25T22:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:build_of_apicurio_registry:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B80ACBA3-FFCF-44E6-A77E-0BD398F0C4D7", "versionEndIncluding": "3.2", "versionStartIncluding": "3.0"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}