{"id":"CVE-2026-12992","kind":"vulnerability","aliases":["CVE-2026-12992","GHSA-rcmh-vfq7-8gf4"],"related":[],"title":"Apicurio Registry allows upload of WSDL raising HTTP request","description":"A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).","summary":"Apicurio Registry's WSDL validator follows import locations inside an uploaded WSDL file when the VALIDITY rule is set to FULL. A user with Developer-role access can make the registry send HTTP requests to arbitrary internal addresses, which is server-side request forgery.","severity":"high","cvss":7.4,"epss":0.00338,"exploited":false,"exploited_at":null,"products":[{"name":"io.apicurio:apicurio-registry-schema-util-wsdl","fixed":["3.3.1"],"affected":">= 3.3.0, < 3.3.1","ecosystem":"maven"},{"name":"io.apicurio:apicurio-registry-schema-util-wsdl","fixed":["3.2.6"],"affected":"< 3.2.6","ecosystem":"maven"},{"name":"redhat build of apicurio registry","fixed":[],"affected":">= 3.0, <= 3.2","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["apicurio-registry","cwe-918","java","maven","package","schema-registry","wsdl"],"not_affected_if":["auth-required","validity-rule-not-full","wsdl-not-used"],"how_to_check":"- Check the version of `io.apicurio:apicurio-registry-schema-util-wsdl` in your build files or dependency tree (e.g. `mvn dependency:tree | grep apicurio-registry-schema-util-wsdl`).\n- Check whether the WSDL artifact type is in use and whether the VALIDITY rule is set to FULL in the registry configuration.","fix":"- `io.apicurio:apicurio-registry-schema-util-wsdl` `3.3.1` for the 3.3.x line\n- `io.apicurio:apicurio-registry-schema-util-wsdl` `3.2.6` for versions below 3.2.6","status":"open","published_at":"2026-06-25T22:17:00+00:00","first_seen_at":"2026-11-04T18:11:56+00:00","triaged_at":"2026-11-04T18:12:48+00:00","updated_at":"2026-11-04T18:28:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T18:12:48Z","model":"claude-haiku-5-5","output":{"fix":"- `io.apicurio:apicurio-registry-schema-util-wsdl` `3.3.1` for the 3.3.x line\n- `io.apicurio:apicurio-registry-schema-util-wsdl` `3.2.6` for versions below 3.2.6","reach":"network","title":"Apicurio Registry: WSDL upload makes server fetch attacker-chosen internal URLs","impact":"medium","summary":"Apicurio Registry's WSDL validator follows import locations inside an uploaded WSDL file when the VALIDITY rule is set to FULL. A user with Developer-role access can make the registry send HTTP requests to arbitrary internal addresses, which is server-side request forgery.","audience":"developers","category":"package","nicknames":[],"who_cares":["apicurio-registry","java","maven","wsdl","schema-registry"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Registry makes internal HTTP requests to attacker-chosen addresses, exposing internal services.","analyst_note":"","how_to_check":"- Check the version of `io.apicurio:apicurio-registry-schema-util-wsdl` in your build files or dependency tree (e.g. `mvn dependency:tree | grep apicurio-registry-schema-util-wsdl`).\n- Check whether the WSDL artifact type is in use and whether the VALIDITY rule is set to FULL in the registry configuration.","plain_action":"","needs_analyst":false,"not_affected_if":["wsdl-not-used","validity-rule-not-full","auth-required"],"who_is_affected":"Teams that run Apicurio Registry and use the WSDL schema type with the VALIDITY rule set to FULL are exposed, since that is the path that fetches imports. Deployments that keep the rule at a lower level or do not handle WSDL schemas are not on the vulnerable path. Developers with Developer-role accounts are the attackers the advisory describes, so restricting who holds that role also narrows the exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000801,"input_tokens":4354,"output_tokens":731,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-12992':12A,20A '-2026':11A,19A '-918':44B '8gf4':17A 'access':79B,130C 'address':90B 'allow':3A 'apicurio':1A,23A,30A,38A,41B,52B,103C 'apicurio-registri':40B 'apicurio-registry-schema-util-wsdl':22A,29A 'arbitrari':88B,150C 'attack':125C,138C 'attacker-control':137C 'build':36A 'caus':142C 'contain':136C 'control':139C 'creat':107C 'cve':10A,18A 'cwe':43B 'develop':77B,128C 'developer-rol':76B,127C 'disabl':112C 'document':135C 'featur':115C 'file':64B 'flaw':99C 'follow':57B 'forgeri':97B,157C 'found':101C 'full':72B,123C 'ghsa':14A 'ghsa-rcmh-vfq7-8gf4':13A 'http':8A,85B,147C 'import':58B,140C 'insid':60B 'intern':89B,151C 'io.apicurio':21A,28A 'issu':146C 'java':45B 'javax.wsdl.importdocuments':114C 'locat':59B,141C 'make':81B 'maven':46B 'of':37A 'packag':47B 'rais':7A 'rcmh':15A 'redhat':35A 'registri':2A,42B,50B,53B,83B,104C,144C 'registry':24A,31A,39A 'request':9A,86B,96B,148C,156C 'role':78B,129C 'rule':68B,119C 'schema':25A,32A,49B 'schema-registri':48B 'send':84B 'server':94B,154C 'server-sid':93B,153C 'set':70B,121C 'side':95B,155C 'upload':4A,62B,132C 'url':152C 'user':74B 'util':26A,33A 'valid':56B,67B,118C 'vfq7':16A 'without':111C 'wsdl':6A,27A,34A,51B,55B,63B,134C 'wsdl4j':109C 'wsdlreader':110C 'wsdlreaderaccessor':106C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Apicurio Registry and use the WSDL schema type with the VALIDITY rule set to FULL are exposed, since that is the path that fetches imports. Deployments that keep the rule at a lower level or do not handle WSDL schemas are not on the vulnerable path. Developers with Developer-role accounts are the attackers the advisory describes, so restricting who holds that role also narrows the exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["buildofapicurioregistry","ioapicurioapicurioregistryschemautilwsdl","redhatbuildofapicurioregistry"],"ptokens":["apicurio","build","io","of","redhat","registry","schema","util","wsdl"],"labels":["apicurioregistry","cwe918","high","java","maven","package","schemaregistry","vendor","wsdl"],"campaign_type":null,"first_public_at":"2026-06-25T22:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-rcmh-vfq7-8gf4","url":"https://github.com/advisories/GHSA-rcmh-vfq7-8gf4","severity":"high","published_at":"2026-06-26T00:32:05+00:00","modified_at":"2026-11-04T18:10:07+00:00","first_seen_at":"2026-11-04T18:11:56+00:00","fetched_at":"2026-11-04T18:17:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-12992","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12992","severity":null,"published_at":"2026-06-25T22:17:00+00:00","modified_at":"2026-10-25T22:10:00+00:00","first_seen_at":"2026-11-04T18:28:34+00:00","fetched_at":"2026-11-04T18:28:34+00:00","note":null}],"documents":[{"id":69019,"url":"https://github.com/Apicurio/apicurio-registry/releases/tag/3.3.1","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":69016,"url":"https://github.com/Apicurio/apicurio-registry/commit/48369d0e9008f7aab16dce5970c1ecbdd55e9aa5","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":69214,"url":"https://github.com/Apicurio/apicurio-registry/commit/f624183fc04ad63caf4d1b123802ae2acc10ff4b","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":69018,"url":"https://github.com/Apicurio/apicurio-registry/releases/tag/3.2.6","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":69212,"url":"https://github.com/Apicurio/apicurio-registry/pull/8198","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":69376,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491691","title":"Vendor advisory: bugzilla.redhat.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: bugzilla.redhat.com"},{"id":69377,"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12992.json","title":"Vendor advisory: security.access.redhat.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: security.access.redhat.com"},{"id":69375,"url":"https://access.redhat.com/security/cve/CVE-2026-12992","title":"Vendor advisory: access.redhat.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: access.redhat.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}