CVE-2026-12894
Received Received - Intake

ReflectionValueResolver Bypass in Quarkus via Enum Access

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: redhat-SADP

Description
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-12894
EUVD
EUVD-2026-68505

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
quarkus qute *
red_hat quarkus *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Template Injection (SSTI) vulnerability in the Quarkus Qute template engine. It exists in the ReflectionValueResolver component which fails to block access to sensitive Java internal functions when processing data types like Enums. An attacker who can influence template text can exploit this to execute unauthorized commands and take control of the server.

Detection Guidance

Detecting this SSTI vulnerability requires checking for Quarkus Qute template engine usage and inspecting template inputs. Monitor logs for unusual template processing requests or errors. Inspect network traffic for requests containing Enums or dynamic content in templates. Use static analysis tools to scan Java applications for Qute dependencies and template injection patterns.

Impact Analysis

This vulnerability allows attackers to execute unauthorized commands on the server, potentially leading to complete compromise of the affected application. This could result in data theft, system damage, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which would violate compliance requirements under GDPR and HIPAA. Organizations may face legal penalties, loss of trust, and reputational damage if this flaw is exploited.

Mitigation Strategies

Ensure untrusted input is not directly incorporated into template content and restrict template rendering functionality to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12894. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart