CVE-2026-12992
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A Server-Side Request Forgery (SSRF) vulnerability was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs.
Risk Assessment
The risk includes the ability to scan internal networks, access sensitive services or data, and potentially perform SSRF attacks against the organization's infrastructure.
Recommendation
It is recommended to immediately update Apicurio Registry to a version where the javax.wsdl.importDocuments feature is disabled in WSDLReaderAccessor. Until the update, restrict registry access to trusted users and consider changing the VALIDITY rule to something other than FULL.
Other vulnerabilities in Apicurio Registry
See all- CVE-2026-12993Medium
A vulnerability in Apicurio Registry occurs because DocumentBuilderAccessor does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING, although it blocks external DTD and schema access. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant), causing CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.
- CVE-2026-12975High
A flaw was found in Apicurio Registry where the ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind SSRF via external DTD/entity fetch, or cause denial of service via entity expansion.
Original NVD description (English source)
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).