Executive brief
Apicurio Registry, a service for managing and storing API schemas and artifacts, is vulnerable to a security flaw that allows users with developer-level access to perform unauthorized network requests. By uploading a specially crafted WSDL file, an attacker can force the registry to connect to internal servers or cloud metadata services that should not be accessible. This could lead to the exposure of sensitive internal information or further attacks against the organization's private infrastructure.
Technical details
A flaw exists in the WSDL validation path of Apicurio Registry. The WSDLReaderAccessor component instantiates a wsdl4j WSDLReader without disabling the 'javax.wsdl.importDocuments' feature. When the registry's VALIDITY rule is set to FULL, the WsdlContentValidator performs recursive fetching of URLs defined in <wsdl:import> and <xsd:import> tags using java.net.URL.openStream() without an allow-list. An attacker with Developer-role access can exploit this to perform Server-Side Request Forgery (SSRF) against internal infrastructure or cloud metadata endpoints. Remediation involves explicitly disabling document imports and XML schema parsing in the WSDLReader configuration.
Affected products
- Red Hat Apicurio Registry 3 3
Timeline
- 2026-06-23: other: Bug reported to Red Hat Bugzilla
- 2026-06-25: advisory: CVE published by NVD and Red Hat