HIGH 8.8 NVD
CVE-2026-12894
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.
References
- https://access.redhat.com/security/cve/CVE-2026-12894
- https://bugzilla.redhat.com/show_bug.cgi?id=2491319
This high severity vulnerability with a CVSS score of 8.8 was published on 2026-08-31 via NVD.
vulnfeed aggregates 11521 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.