# CVE-2026-12992: Red Hat Apicurio Registry SSRF in WSDL validation

Source: https://junglewise.ai/threats/cve-2026-12992-red-hat-apicurio-registry-ssrf-in-wsdl-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-12992 · Severity: high · CVSS 7.4 · Published 2026-06-25

Apicurio Registry, a service for managing and storing API schemas and artifacts, is vulnerable to a security flaw that allows users with developer-level access to perform unauthorized network requests. By uploading a specially crafted WSDL file, an attacker can force the registry to connect to internal servers or cloud metadata services that should not be accessible. This could lead to the exposure of sensitive internal information or further attacks against the organization's private infrastructure.

Technologies: [Red Hat Apicurio Registry 3](https://junglewise.ai/threats/technologies/apicurio-registry-3). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-12992 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12992 being exploited in the wild.

**How severe is CVE-2026-12992?** High severity, with a CVSS score of 7.4, published 25 June 2026.

**Which products and versions are affected?** io.apicurio:apicurio-registry-schema-util-wsdl (Maven) >= 3.3.0, < 3.3.1, ECOSYSTEM:introduced=3.3.0,fixed=3.3.1; Red Hat Apicurio Registry 3 3.

**Is there a fix for CVE-2026-12992?** Yes. io.apicurio:apicurio-registry-schema-util-wsdl (Maven): upgrade to 3.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12992 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-12992?** Check whether you run io.apicurio:apicurio-registry-schema-util-wsdl (Maven) or Red Hat Apicurio Registry 3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.apicurio:apicurio-registry-schema-util-wsdl (Maven): upgrade to 3.3.1 or later

  ```sh
  # set io.apicurio:apicurio-registry-schema-util-wsdl to 3.3.1 in your pom.xml or build.gradle
  ```


## Technical details

A flaw exists in the WSDL validation path of Apicurio Registry. The WSDLReaderAccessor component instantiates a wsdl4j WSDLReader without disabling the 'javax.wsdl.importDocuments' feature. When the registry's VALIDITY rule is set to FULL, the WsdlContentValidator performs recursive fetching of URLs defined in <wsdl:import> and <xsd:import> tags using java.net.URL.openStream() without an allow-list. An attacker with Developer-role access can exploit this to perform Server-Side Request Forgery (SSRF) against internal infrastructure or cloud metadata endpoints. Remediation involves explicitly disabling document imports and XML schema parsing in the WSDLReader configuration.

## Affected products

- Red Hat Apicurio Registry 3 3

## Identifiers

- CVE-2026-12992
- GHSA-rcmh-vfq7-8gf4

## Timeline

- 2026-06-23: other: Bug reported to Red Hat Bugzilla
- 2026-06-25: advisory: CVE published by NVD and Red Hat

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-12992](https://access.redhat.com/security/cve/CVE-2026-12992)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2491691](https://bugzilla.redhat.com/show_bug.cgi?id=2491691)