Red Hat Security Advisory: Red Hat build of Quarkus 3.27.5.SP1 release and security update

CVE-2026-12894 is a Server-Side Template Injection vulnerability in the ReflectionValueResolver component of the Qute template engine used by Red Hat Build of Apache Camel 4.18 for Quarkus. This vulnerability allows attackers who can control template input to bypass security restrictions and execute unauthorized commands on the server. The issue affects versions from 3.27.0 through 3.33.0 inclusive. Red Hat has released an update, RHBQ 3.33.3.SP1, which includes a fix for this vulnerability along with other security issues. The advisory rates the security impact as important.

An attacker able to influence template text can exploit this vulnerability to bypass restrictions and execute unauthorized commands on the server, potentially leading to unauthorized code execution or data compromise within affected Red Hat Build of Apache Camel for Quarkus environments.

Red Hat has released an official update, RHBQ 3.33.3.SP1, which addresses this vulnerability and other security issues. Users should apply this update to remediate the vulnerability. Before applying the update, back up existing installations, including applications, configuration files, and databases. Patch status is confirmed as fixed in RHBQ 3.33.3.SP1.