A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-12992 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2491691 | Issue Tracking Vendor Advisory |
| https://access.redhat.com/security/cve/CVE-2026-12992 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2491691 | Issue Tracking Vendor Advisory |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12992.json | Vendor Advisory |
Configurations
History
06 Jul 2026, 18:12
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:redhat:build_of_apicurio_registry:*:*:*:*:*:*:*:* | |
| First Time |
Redhat build Of Apicurio Registry
Redhat |
|
| References | () https://access.redhat.com/security/cve/CVE-2026-12992 - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2491691 - Issue Tracking, Vendor Advisory | |
| References | () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12992.json - Vendor Advisory |
30 Jun 2026, 03:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| References | () https://access.redhat.com/security/cve/CVE-2026-12992 - | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2491691 - |
25 Jun 2026, 22:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-25 22:17
Updated : 2026-07-15 02:18
NVD link : CVE-2026-12992
Mitre link : CVE-2026-12992
CVE.ORG link : CVE-2026-12992
JSON object : View
Products Affected
redhat
- build_of_apicurio_registry
CWE
CWE-918
Server-Side Request Forgery (SSRF)