Dashboard / CVE-2026-12992

CVE-2026-12992

INFO Priority: 0.00 BB Relevance: 0/100
Published: 2026-06-25 Modified: 2026-10-25 First seen: 2026-10-29 Status: pending_score

Description

A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
redhat build_of_apicurio_registry 3.0 – 3.2

References & Advisories (4)

Bug Bounty Relevance

0 / 100

CVSS Score

Unscored

EPSS — Exploitation Probability

0.34%
Raw Score 0.003380
Percentile 27.2%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00338
2026-10-28
0.00338

Intelligence Sources

nvd ref →

External Links