Apicurio Registry CVE-2026-12992

Exploitation requires an authenticated account holding the Developer role (CVSS PR:L) and the registry's VALIDITY content rule must be set to FULL - this is the explicit configuration trigger named in the description; with validation disabled or set to syntax-only the import locations are not dereferenced. The attacker must be able to submit a WSDL artifact containing attacker-controlled <wsdl:import> locations. No user interaction is needed (UI:N) and the registry must be network-reachable to the attacker (AV:N). Limiting factors: the Developer-role authentication requirement and the non-default FULL validation setting both narrow the realistic attack surface, and the practical payoff depends on what internal URLs the server can reach.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L, 7.4) reflects a network-reachable, low-complexity attack that needs low privileges (PR:L, the Developer role) and no user interaction, with a changed scope because the SSRF reaches systems beyond the registry's own security authority. The scope change and the realistic ability to probe internal-only services are what elevate this above a routine medium-severity finding. Countervailing signals temper the priority: it is not in CISA KEV, no POC or exploit code has surfaced, and EPSS was not provided, so widespread or automated exploitation is not indicated. Critically, exploitation depends on two gating factors not captured fully by the raw score - the attacker must already hold an authenticated Developer-role account, and the VALIDITY rule must be configured to FULL (not the default for many deployments). The CVSS C:L/I:L/A:L impacts are conservative for SSRF, which is most reliably a confidentiality/reconnaissance primitive; integrity and availability impact on internal targets is situational and depends on which internal endpoints accept GET-style requests. Net: a real but conditional risk best treated as a prioritized internal-hardening item rather than an emergency.

An attacker with a Developer-role account on an Apicurio Registry 3 instance that has the VALIDITY rule set to FULL uploads a WSDL artifact whose <wsdl:import> location points at an internal-only address such as http://169.254.169.254/latest/meta-data/ or an internal admin service. During full validation the registry server dereferences that location, letting the attacker map internal services or pull data reachable only from the server. No public exploit code is identified, but the attack is straightforward to reproduce given the prerequisites.