CVE-2026-12992: Apicurio Registry allows upload of WSDL raising HTTP request
(updated )
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).
References
- access.redhat.com/errata/RHSA-2026:59360
- access.redhat.com/security/cve/CVE-2026-12992
- bugzilla.redhat.com/show_bug.cgi?id=2491691
- github.com/Apicurio/apicurio-registry/commit/48369d0e9008f7aab16dce5970c1ecbdd55e9aa5
- github.com/Apicurio/apicurio-registry/commit/f624183fc04ad63caf4d1b123802ae2acc10ff4b
- github.com/Apicurio/apicurio-registry/issues/8188
- github.com/Apicurio/apicurio-registry/pull/8198
- github.com/Apicurio/apicurio-registry/releases/tag/3.2.6
- github.com/Apicurio/apicurio-registry/releases/tag/3.3.1
- github.com/advisories/GHSA-rcmh-vfq7-8gf4
- nvd.nist.gov/vuln/detail/CVE-2026-12992
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12992.json
Code Behaviors & Features
Detect and mitigate CVE-2026-12992 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →