CVE-2026-12992
High
Description
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).
SeverityHigh
CVSS7.4
Exploit probability—
Product
Redhat Build Of Apicurio Registry
PublishedJun 25, 2026
First seenJun 25, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- io.apicurio:apicurio-registry-schema-util-wsdl3.3.1, 3.2.6 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat build_of_apicurio_registry | 3.0 ≤ v ≤ 3.2 | — |
| io.apicurio:apicurio-registry-schema-util-wsdlMaven | 3.3.0 ≤ v < 3.3.1, v < 3.2.6 | 3.3.1, 3.2.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.