High

Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

Type: advisorySource: Official CVE List1 source record

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.

Announced 31 Aug 2026Group revision 1

Original source ↗

CVE-2026-12894

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-12894

quarkus-qute

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Apache Camel 3.33.3.SP1

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Quarkus 3.27.5.SP1

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Quarkus 3.33.3.SP1

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Apache Camel 4 for Quarkus 3

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Apache Camel 4 for Quarkus 3

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Apache Camel 4 for Quarkus 3

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform Expansion Pack

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform Expansion Pack

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform Expansion Pack

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Quarkus",
    "product": "quarkus-qute",
    "versions": [
      {
        "status": "affected",
        "version": "3.27.0",
        "lessThan": "3.27.5.SP1",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "3.33.0",
        "lessThan": "3.33.3.SP1",
        "versionType": "semver"
      }
    ],
    "packageName": "io.quarkus:quarkus-qute",
    "collectionURL": "https://repo1.maven.org/maven2",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:apache_camel_quarkus:3.33"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Build of Apache Camel 3.33.3.SP1",
    "versions": [
      {
        "status": "unaffected",
        "version": "3.33.3.redhat-00005",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "io.quarkus/quarkus-qute",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:quarkus:3.27"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Quarkus 3.27.5.SP1",
    "versions": [
      {
        "status": "unaffected",
        "version": "3.27.5.redhat-00004",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "io.quarkus/quarkus-qute",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:quarkus:3.33"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Quarkus 3.33.3.SP1",
    "versions": [
      {
        "status": "unaffected",
        "version": "3.33.3.redhat-00005",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "io.quarkus/quarkus-qute",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
    "packageName": "camel-quarkus-qute",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
    "packageName": "camel-quarkus-qute-component",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
    "packageName": "quarkus-qute",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jbosseapxp"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "packageName": "camel-quarkus-qute",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jbosseapxp"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "packageName": "camel-quarkus-qute-component",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jbosseapxp"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "packageName": "quarkus-qute",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  }
]

Related CVEs: CVE-2026-12894
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #42125 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 11:39:20 GMT
Publisher date: Mon, 31 Aug 2026 12:14:12 GMT

Read the original announcement

Revision history

25 Oct 2026CVE-2026-12894 · Revision 1Source updated