CVE-2026-12992

Name of the Vulnerable Software and Affected Versions Apicurio Registry (affected versions not specified)

Description A flaw exists where the WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, a user with Developer-role access can upload a WSDL document containing malicious import locations. This leads to Server-Side Request Forgery (SSRF), a condition where the server is coerced into making unauthorized HTTP requests to arbitrary internal URLs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.