Search: CVE-2026-12894

CVE-2026-12894 is a high-severity server-side template injection vulnerability in the Quarkus Qute template engine. The flaw exists in the ReflectionValueResolver component, which improperly restricts access to sensitive Java internal functions when processing certain data types like Enums. An attacker able to influence template text can exploit this to execute unauthorized commands on the server. Red Hat has issued an important security advisory with updates that address this vulnerability in specific versions of the Red Hat Build of Apache Camel for Quarkus.