CVE-2026-12894Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine
Updated under an hour ago ()
Does this affect you?
It affects quarkus-qute and 4 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-1336
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- redhat
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 12, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Quarkus quarkus-qute quarkus:qute (from the name) | from 3.27.0 before 3.27.5.SP1; from 3.33.0 before 3.33.3.SP1 | CNA record |
Red Hat Red Hat Build of Apache Camel 3.33.3.SP1 redhat:apache_camel_quarkus | from 3.33.3.redhat-00005 not affected | CNA record |
Red Hat Red Hat build of Quarkus 3.27.5.SP1 redhat:quarkus | 3.27 | CNA record |
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 redhat:camel_quarkus | 3 | CNA record |
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack redhat:jbosseapxp | Versions not stated | CNA record |
References
- https://access.redhat.com/errata/RHSA-2026:62515vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:62555vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:63302vendor-advisory, x-refsource-redhat
- https://access.redhat.com/security/cve/CVE-2026-12894vdb-entry, x-refsource-redhat
- https://bugzilla.redhat.com/show_bug.cgi?id=2491319issue-tracking, x-refsource-redhat
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.