Vulnerability in Quarkus Quarkus-Qute
CVE-2026-12894
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (41.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 42nd percentile — 41.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.001
Affected products
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-12894 (vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking)
- access.redhat.com/errata/RHSA-2026:63302 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:62515 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:62555 (vendor-advisory)
Frequently asked questions
- What is CVE-2026-12894?
- CVE-2026-12894 is a high-severity vulnerability in Quarkus Quarkus-Qute, classified under Improper Neutralization of Special Elements Used in a Template Engine. CVSS score: 8.8/10. Published 2026-08-31.
- How severe is CVE-2026-12894?
- High severity. CVSS v3 base score is 8.8 out of 10.