CVE-2026-12992

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12992", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-06-23T12:14:13.060Z", "datePublished": "2026-06-25T21:16:11.720Z", "dateUpdated": "2026-11-05T02:18:43.249Z"}, "containers": {"cna": {"title": "Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery)."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "apicurio/apicurio-registry-rhel8", "cpes": ["cpe:/a:redhat:apicurio_registry:3.3"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "apicurio/apicurio-registry-rhel9", "cpes": ["cpe:/a:redhat:apicurio_registry:3.3"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59360", "name": "RHSA-2026:59360", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-12992", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491691", "name": "RHBZ#2491691", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-06-10T13:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "Server-Side Request Forgery", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-918: Server-Side Request Forgery", "timeline": [{"lang": "en", "time": "2026-05-24T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-10T13:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-05T02:18:43.249Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-25T21:35:41.868366Z", "id": "CVE-2026-12992", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T21:35:50.805Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "defaultStatus": "affected", "packageName": "apicurio/apicurio", "product": "Red Hat build of Apicurio Registry 3.3.1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "registry-rhel8", "versionType": "rpm"}, {"lessThan": "*", "status": "unaffected", "version": "registry-rhel9", "versionType": "rpm"}]}], "datePublic": "2026-06-10T13:00:00.000Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery)."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-12992"}, {"name": "RHBZ#2491691", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491691"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12992.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:59360"}], "solutions": [{"lang": "en", "value": "RHSA-2026:59360: Red Hat build of Apicurio Registry 3.3.1"}], "timeline": [{"lang": "en", "time": "2026-05-24T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-10T13:00:00.000Z", "value": "Made public."}], "title": "Apicurio/apicurio-registry: apicurio-registry: SSRF via wsdl4j import dereference in WSDL FULL validation", "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-26T12:04:56.516Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "Apicurio/apicurio-registry: apicurio-registry: SSRF via wsdl4j import dereference in WSDL FULL validation", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "versions": [{"status": "unaffected", "version": "registry-rhel8", "lessThan": "*", "versionType": "rpm"}, {"status": "unaffected", "version": "registry-rhel9", "lessThan": "*", "versionType": "rpm"}], "packageName": "apicurio/apicurio", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-05-24T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-10T13:00:00.000Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:59360: Red Hat build of Apicurio Registry 3.3.1"}], "x_adpType": "supplier", "datePublic": "2026-06-10T13:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-12992", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491691", "name": "RHBZ#2491691", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12992.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59360", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-26T12:04:56.516Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12992", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T21:35:41.868366Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T21:35:46.386Z"}}], "cna": {"title": "Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "packageName": "apicurio/apicurio-registry-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3.3.1", "packageName": "apicurio/apicurio-registry-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-24T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-10T13:00:00.000Z", "value": "Made public."}], "datePublic": "2026-06-10T13:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59360", "name": "RHSA-2026:59360", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-12992", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491691", "name": "RHBZ#2491691", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-05T02:18:43.249Z"}, "x_redhatCweChain": "CWE-918: Server-Side Request Forgery"}}, "cveMetadata": {"cveId": "CVE-2026-12992", "state": "PUBLISHED", "dateUpdated": "2026-11-05T02:18:43.249Z", "dateReserved": "2026-06-23T12:14:13.060Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-06-25T21:16:11.720Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "defaultStatus": "unaffected", "packageName": "apicurio/apicurio-registry-rhel8", "product": "Red Hat build of Apicurio Registry 3.3.1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "defaultStatus": "unaffected", "packageName": "apicurio/apicurio-registry-rhel9", "product": "Red Hat build of Apicurio Registry 3.3.1", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apicurio_registry:3.3"], "defaultStatus": "affected", "packageName": "apicurio/apicurio", "product": "Red Hat build of Apicurio Registry 3.3.1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "registry-rhel8", "versionType": "rpm"}, {"lessThan": "*", "status": "unaffected", "version": "registry-rhel9", "versionType": "rpm"}]}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:build_of_apicurio_registry:*:*:*:*:*:*:*:*", "matchCriteriaId": "B80ACBA3-FFCF-44E6-A77E-0BD398F0C4D7", "versionEndIncluding": "3.2", "versionStartIncluding": "3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery)."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en Apicurio Registry. El WSDLReaderAccessor crea un WSDLReader de wsdl4j sin deshabilitar la caracter\u00edstica javax.wsdl.importDocuments. Cuando la regla VALIDITY est\u00e1 configurada en FULL, un atacante con acceso de rol de Desarrollador puede cargar un documento WSDL que contenga ubicaciones de importaci\u00f3n controladas por el atacante, lo que hace que el registro emita peticiones HTTP a URLs internas arbitrarias (falsificaci\u00f3n de petici\u00f3n del lado del servidor)."}], "id": "CVE-2026-12992", "lastModified": "2026-10-25T22:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 3.7, "source": "secalert@redhat.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 3.7, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12992", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-25T21:35:41.868366Z", "version": "2.0.3"}}]}, "published": "2026-06-25T22:17:00.760", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59360"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2026-12992"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491691"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:59360"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2026-12992"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491691"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Vendor Advisory"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12992.json"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-918"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "Apicurio/apicurio-registry: apicurio-registry: SSRF via wsdl4j import dereference in WSDL FULL validation", "id": "2491691", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491691"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery)."], "name": "CVE-2026-12992", "package_state": [{"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Affected", "package_name": "apicurio/apicurio-registry-rhel8", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Affected", "package_name": "apicurio/apicurio-registry-rhel9", "product_name": "Red Hat build of Apicurio Registry 3"}], "public_date": "2026-06-10T13:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-12992\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-12992"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat build of Apicurio Registry 3", "source": "cna", "vendor": "Red Hat"}, "product": "apicurio_registry", "vendor": "redhat"}], "created": "2026-06-25T22:30:15.191570+00:00", "updated": "2026-06-26T09:36:10.078910+00:00", "vendors": ["redhat", "redhat$PRODUCT$apicurio_registry"]}