{"id":"CVE-2026-66089","kind":"vulnerability","aliases":["CVE-2026-66089"],"related":[],"title":"openEQUELLA: SOAP stopEdit parser lets attackers read server files","description":"In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).","summary":"openEQUELLA before 2026.1 parses XML sent to its SOAP stopEdit operation with an XML parser that resolves external entities. An attacker can read files the openEQUELLA service can access and make the server send requests to addresses of their choosing (SSRF).","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["openequella","package","self-hosted","soap-api"],"not_affected_if":["version-2026.1-or-later"],"how_to_check":"- Check the installed openEQUELLA version against `2026.1`; anything older is in scope.\n- Confirm whether the SOAP API endpoint is reachable from untrusted networks.","fix":"- Upgrade openEQUELLA to `2026.1` or later.\n- Unknown whether a configuration-only mitigation exists; the sources do not say.","status":"open","published_at":"2026-10-29T02:16:52+00:00","first_seen_at":"2026-10-29T02:36:48+00:00","triaged_at":"2026-10-29T02:38:04+00:00","updated_at":"2026-10-29T02:38:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T02:38:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade openEQUELLA to `2026.1` or later.\n- Unknown whether a configuration-only mitigation exists; the sources do not say.","reach":"network","title":"openEQUELLA: SOAP stopEdit parser lets attackers read server files","impact":"medium","summary":"openEQUELLA before 2026.1 parses XML sent to its SOAP stopEdit operation with an XML parser that resolves external entities. An attacker can read files the openEQUELLA service can access and make the server send requests to addresses of their choosing (SSRF).","category":"package","nicknames":[],"who_cares":["openequella","self-hosted","soap-api"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Server files readable and internal requests made by the server","analyst_note":"Check the NVD entry and openEQUELLA release notes for whether authentication is required for stopEdit and whether a workaround exists before 2026.1.","how_to_check":"- Check the installed openEQUELLA version against `2026.1`; anything older is in scope.\n- Confirm whether the SOAP API endpoint is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["version-2026.1-or-later"],"who_is_affected":"Teams running openEQUELLA before 2026.1 with the SOAP API exposed to users or networks that should not reach it. Deployments where the SOAP API is not reachable from untrusted networks have less exposure. The sources do not say whether authentication is required for stopEdit.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000615,"input_tokens":3328,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-66089':12A,15A '2026.1':26B,68C 'access':52B,94C 'address':60B 'allow':87C 'api':23B,71C 'arbitrari':92C 'attack':6A,44B,89C,108C 'attacker-specifi':107C 'caus':100C 'choos':63B 'cve':10A,13A 'entiti':42B,85C 'extern':41B,84C 'file':9A,47B,93C 'host':20B 'issu':104C 'let':5A 'locat':110C 'make':54B 'openequella':1A,16B,24B,49B,66C,97C 'oper':34B,78C 'packag':17B 'pars':27B,72C 'parser':4A,38B,81C 'read':7A,46B,91C 'request':58B,105C 'resolv':40B,83C 'self':19B 'self-host':18B 'send':57B 'sent':29B 'server':8A,56B,102C 'servic':50B,98C 'soap':2A,22B,32B,70C 'soap-api':21B 'specifi':109C 'ssrf':64B,111C 'stopedit':3A,33B,77C 'suppli':74C 'xml':28B,37B,73C","nicknames":[],"mitigations":[],"who_affected":"Teams running openEQUELLA before 2026.1 with the SOAP API exposed to users or networks that should not reach it. Deployments where the SOAP API is not reachable from untrusted networks have less exposure. The sources do not say whether authentication is required for stopEdit.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T02:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-66089","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66089","severity":null,"published_at":"2026-10-29T02:16:52+00:00","modified_at":"2026-10-29T02:16:52+00:00","first_seen_at":"2026-10-29T02:36:48+00:00","fetched_at":"2026-10-29T02:36:48+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}