---
id: "CVE-2026-66089"
kind: "vulnerability"
aliases: ["CVE-2026-66089"]
title: "openEQUELLA: SOAP stopEdit parser lets attackers read server files"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["openequella", "package", "self-hosted", "soap-api"]
not_affected_if: ["version-2026.1-or-later"]
published_at: "2026-10-29T02:16:52+00:00"
first_seen_at: "2026-10-29T02:36:48+00:00"
updated_at: "2026-10-29T02:38:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66089", "first_seen_at": "2026-10-29T02:36:48+00:00"}]
---

# openEQUELLA: SOAP stopEdit parser lets attackers read server files

openEQUELLA before 2026.1 parses XML sent to its SOAP stopEdit operation with an XML parser that resolves external entities. An attacker can read files the openEQUELLA service can access and make the server send requests to addresses of their choosing (SSRF).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed openEQUELLA version against `2026.1`; anything older is in scope.
- Confirm whether the SOAP API endpoint is reachable from untrusted networks.

## Fix

- Upgrade openEQUELLA to `2026.1` or later.
- Unknown whether a configuration-only mitigation exists; the sources do not say.

## Timeline

- 2026-10-29T02:36:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-66089

## From the sources

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_