High [CVE-2026-12894] Quarkus-qute: io.quarkus.qute.reflectionvalueresolver: quarkus:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine
This high-severity Red Hat Linux advisory covers CVE-2026-12894 affecting Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Quarkus, Red Hat JBoss Enterprise Application Platform Expansion Pack.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums.
An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands. An attacker with the ability to supply or modify template content can bypass security filters designed to restrict access to sensitive Java methods.
This bypass allows for arbitrary remote code execution within the context of the Java process, leading to a complete compromise of the affected application. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Weakness: CWE-1336. Affected Red Hat products: Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Quarkus; Red Hat JBoss Enterprise Application Platform Expansion Pack.
Red Hat does not currently list a fixing RHSA for this CVE.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- Applications utilizing the Quarkus Qute template engine should ensure that untrusted input is not directly incorporated into template content. Restricting access to the application's template rendering functionality to trusted sources can reduce the attack surface.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.