Akana API Platform CVE-2026-89212

Exploitation requires an Akana endpoint that accepts attacker-supplied XML and routes it through the vulnerable XML-to-JSON processing path; the attacker must be able to submit XML containing a DOCTYPE/external-entity declaration. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or special client-side conditions are needed - unauthenticated remote requests against an exposed Akana API surface suffice. Limiting factors: the target Akana instance must be reachable and must actually invoke the XML-to-JSON conversion on the untrusted payload, and successful data exfiltration for blind/out-of-band variants depends on the server being able to make outbound network connections.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H, SC:H, SI:L) describes a clean unauthenticated, low-complexity, no-interaction network attack with high confidentiality impact on the vulnerable system and a subsequent-system confidentiality impact of High - consistent with XXE used for local file disclosure and SSRF into adjacent/backend systems. Because Akana is an API gateway that often sits at the network edge and accepts XML from untrusted clients, the practical exposure is significant despite there being no EPSS score, no CISA KEV listing, and no public POC in the provided data. The absence of published exploit code and KEV status suggests this is not yet a mass-exploited issue, so it is a proactive-patch priority rather than an active-incident one; even a mid-sized operator should treat an internet-facing Akana instance as urgent given XXE's well-understood exploitation techniques. The SI:L rating hints that entity-injection could also perturb processed data integrity, but the dominant risk is data/credential disclosure and SSRF pivoting.

An attacker sends a crafted XML request containing an external entity (e.g. referencing file:///etc/passwd or an internal URL) to an Akana endpoint that performs XML-to-JSON conversion. The parser resolves the entity during processing, embedding the file contents in the response or triggering an outbound request, letting the unauthenticated attacker read local files or reach internal services (SSRF). No public POC is identified, but XXE exploitation techniques are well documented and the low attack complexity makes weaponization straightforward.