IO.APICURIO:APICURIO-REGISTRY-SCHEMA-UTIL-WSDL · CVE-2026-12992 · Package
FIX → 3.3.1 · 3.2.6
Apicurio Registry's WSDL validator follows import locations inside an uploaded WSDL file when the VALIDITY rule is set to FULL. A user with Developer-role access can make the registry send HTTP requests to arbitrary internal addresses, which is server-side request forgery.
first public Jun 25, 2026 · 2 sources
Running Io.apicurio:apicurio-registry-schema-util-wsdl? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams that run Apicurio Registry and use the WSDL schema type with the VALIDITY rule set to FULL are exposed, since that is the path that fetches imports. Deployments that keep the rule at a lower level or do not handle WSDL schemas are not on the vulnerable path. Developers with Developer-role accounts are the attackers the advisory describes, so restricting who holds that role also narrows the exposure.
Not affected if auth-required, validity-rule-not-full, wsdl-not-used
Who cares apicurio-registry, cwe-918, java, maven, schema-registry, wsdl
io.apicurio:apicurio-registry-schema-util-wsdl in your build files or dependency tree (e.g. mvn dependency:tree | grep apicurio-registry-schema-util-wsdl).A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).
Upgrade to 3.3.1 · 3.2.6
io.apicurio:apicurio-registry-schema-util-wsdl 3.3.1 for the 3.3.x lineio.apicurio:apicurio-registry-schema-util-wsdl 3.2.6 for versions below 3.2.6This page as .md · .json · in your agent: get_signal("CVE-2026-12992") · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.