CVE-2026-12894highCWE-1336

CVE-2026-12894: high-severity vulnerability in quarkus-qute

Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

Published · Updated

Follow this CVE+ Monitor Red Hat JBoss Enterprise Application Platform Expansion Pack+ Monitor Red Hat build of Apache Camel 4 for Quarkus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 1.0%
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Quarkus · quarkus-quteRed Hat · Red Hat Build of Apache Camel 3.33.3.SP1Red Hat · Red Hat build of Apache Camel 4 for Quarkus 3Red Hat · Red Hat build of Quarkus 3.27.5.SP1Red Hat · Red Hat build of Quarkus 3.33.3.SP1Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack
Related CVEs — quarkus-qute

In the same product, most dangerous first.

CVE-2024-1635HIGHUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolEPSS 4.6%CVE-2026-93567HIGHIo.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authorityEPSS 2.6%CVE-2026-93569HIGHIo.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authorityEPSS 2.2%CVE-2024-3653MEDIUMUndertow: learningpushhandler can lead to remote memory dos attacksEPSS 1.9%CVE-2024-1023MEDIUMIo.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxEPSS 1.7%CVE-2024-3884HIGHUndertow: outofmemory when parsing form data encoding with application/x-www-form-urlencodedEPSS 1.5%