Read the docs
TI-2026-10988 Aliases CVE-2026-12894GHSA-w5gv-wrvc-9hx8

Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability…

Priority MEDIUM 42CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-1336.

Summary

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00968 62nd percentileScored 2026-11-07
Fix Partial quarkus-qute (Quarkus): 3.27.5.SP1, 3.33.3.SP1Red Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
quarkusioquarkus-qute3.27.0 to before 3.27.5.SP1; 3.33.0 to before 3.33.3.SP13.27.5.SP1, 3.33.3.SP1Patch availableCNA
Red HatRed Hat Build of Apache Camel 3.33.3.SP1—3.33.3.redhat-00005Patch availableCNA
Red HatRed Hat build of Quarkus 3.27.5.SP1—3.27.5.redhat-00004Patch availableCNA
Red HatRed Hat build of Quarkus 3.33.3.SP1—3.33.3.redhat-00005Patch availableCNA
Red HatRed Hat build of Apache Camel 4 for Quarkus 3——Not affectedCNA
Red HatRed Hat build of Apache Camel 4 for Quarkus 3——Not affectedCNA
Red HatRed Hat build of Apache Camel 4 for Quarkus 3——No fix listedCNA
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack——Not affectedCNA
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack——Not affectedCNA
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack——Not affectedCNA
  • quarkus-qute Vendorquarkusio Affected 3.27.0 to before 3.27.5.SP1; 3.33.0 to before 3.33.3.SP1 Fixed in 3.27.5.SP1, 3.33.3.SP1 Patch available CNA
  • Red Hat Build of Apache Camel 3.33.3.SP1 VendorRed Hat Affected — Fixed in 3.33.3.redhat-00005 Patch available CNA
  • Red Hat build of Quarkus 3.27.5.SP1 VendorRed Hat Affected — Fixed in 3.27.5.redhat-00004 Patch available CNA
  • Red Hat build of Quarkus 3.33.3.SP1 VendorRed Hat Affected — Fixed in 3.33.3.redhat-00005 Patch available CNA
  • Red Hat build of Apache Camel 4 for Quarkus 3 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Apache Camel 4 for Quarkus 3 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Apache Camel 4 for Quarkus 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA

CPE names CNA · 5

CPEVersionsRoleVendor
cpe:/a:redhat:apache_camel_quarkus:3.333.33—Red Hat
cpe:/a:redhat:quarkus:3.273.27—Red Hat
cpe:/a:redhat:quarkus:3.333.33—Red Hat
cpe:/a:redhat:camel_quarkus:33—Red Hat
cpe:/a:redhat:jbosseapxp——Red Hat
  • cpe:/a:redhat:apache_camel_quarkus:3.33 Versions 3.33 — ·Red Hat
  • cpe:/a:redhat:quarkus:3.27 Versions 3.27 — ·Red Hat
  • cpe:/a:redhat:quarkus:3.33 Versions 3.33 — ·Red Hat
  • cpe:/a:redhat:camel_quarkus:3 Versions 3 — ·Red Hat
  • cpe:/a:redhat:jbosseapxp Versions — — ·Red Hat

Remediation

  • Fix · CNA quarkus-qute (Quarkus) Fixed in 3.27.5.SP1, 3.33.3.SP1

Red Hat 3 advisories

  • RHSA-2026:63302 Released 2026-09-03 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)
    • Red Hat Build of Apache Camel 3.33.3.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-qute-3.33.3.redhat-00005.jar +5
  • RHSA-2026:62555 Released 2026-09-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.3.SP1 release and security update
    • Red Hat build of Quarkus 3.33.3.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-oidc-3.33.3.redhat-00005.jar +6
  • RHSA-2026:62515 Released 2026-09-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.5.SP1 release and security update
    • Red Hat build of Quarkus 3.27.5.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-apache-httpclient-3.27.5.redhat-00004.jar +7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Build of Apache Camel 3.33.3.SP1, Red Hat JBoss Enterprise Application Platform Expansion Pack and 3 more products — RHSA-2026:62515

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-53641 Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literalsPriority MEDIUM 40
    • TI-2026-14443 Resteasy-core: resteasy sourceprovider remote unauthenticated file readPriority MEDIUM 40
    Show all 3 records → Advisory →
  • Advisory ·

    Red Hat Build of Apache Camel 3.33.3.SP1, Red Hat JBoss Enterprise Application Platform Expansion Pack and 3 more products — RHSA-2026:62555

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-53641 Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literalsPriority MEDIUM 40
    • TI-2026-14443 Resteasy-core: resteasy sourceprovider remote unauthenticated file readPriority MEDIUM 40
    Show all 3 records → Advisory →
Show 1 more group
  • Advisory ·

    Red Hat Build of Apache Camel 3.33.3.SP1, Red Hat JBoss Enterprise Application Platform Expansion Pack and 3 more products — RHSA-2026:63302

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-14443 Resteasy-core: resteasy sourceprovider remote unauthenticated file readPriority MEDIUM 40
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat Build of Apache Camel 3.33.3.SP1Fixed RHSA-2026:63302
Red Hat build of Quarkus 3.27.5.SP1Fixed RHSA-2026:62515
Red Hat build of Quarkus 3.33.3.SP1Fixed RHSA-2026:62555
Not affected: 5 products
  • Red Hat Build of Apache Camel 3.33.3.SP1
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat build of Quarkus 3.27.5.SP1
  • Red Hat build of Quarkus 3.33.3.SP1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12894
  2. 2026-10-03 Alias added: GHSA-w5gv-wrvc-9hx8
  3. 2026-10-09 Fix available: RHSA-2026:62555 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:63302 · Red Hat
  5. 2026-10-09 Fix available: RHSA-2026:62515 · Red Hat
  6. 2026-10-12 Fix available: io.quarkus/[email protected] · CNA
  7. 2026-10-12 Fix available: Red Hat Build of Apache Camel 3.33.3.SP1, Red Hat build of Quarkus 3.27.5.SP1, Red Hat build of Quarkus 3.33.3.SP1 · Red Hat
  8. 2026-10-20 Fix available: io.quarkus/[email protected] · CNA
  9. 2026-10-20 Affected versions changed · Red Hat
  10. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 3

Other 2

  • TI-2022-06097 Unchecked Class Instantiation when providing Plugin Classes CVSS 3.1CRITICAL 9.8
  • TI-2026-37281 Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities CVSS 3.1HIGH 7.5
  • TI-2022-03763 Injection in quarkus CVSS 3.1CRITICAL 9.8
  • TI-2020-15666 XML external entity injection in jackson-databind CVSS 3.1HIGH 7.5
  • TI-2017-13794 The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load… CVSS 3.1HIGH 7.5
  • TI-2021-08126 block repositories using http by default CVSS 3.1CRITICAL 9.1
See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences