CVE-2026-12992 describes an SSRF vulnerability in Red Hat build of Apicurio Registry 3. The vulnerability is due to the WSDLReaderAccessor creating a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role privileges can upload a crafted WSDL document containing attacker-controlled import locations. This causes the registry to issue HTTP requests to arbitrary internal URLs, enabling SSRF attacks. The CVSS 3.1 base score is 7.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality, integrity, and availability. The vendor advisory from Red Hat is available but does not explicitly state patch or remediation status.

An attacker with Developer-role access can exploit this vulnerability to cause the Apicurio Registry to make HTTP requests to arbitrary internal URLs. This SSRF can lead to unauthorized internal network scanning, information disclosure, or potentially further attacks depending on the internal network configuration. The vulnerability impacts confidentiality, integrity, and availability as per the CVSS vector.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12992 for current remediation guidance. Until an official fix is available, restrict Developer-role access to trusted users only and consider network-level controls to limit outbound HTTP requests from the registry server. Monitor Red Hat's advisory for updates on patches or official mitigations.