CVE-2026-12894

CVE-2026-12894 is a template-engine flaw (CWE-1336) in Qute, the template engine bundled with the Quarkus Java framework: the ReflectionValueResolver fails to properly block access to sensitive Java internal functions when resolving values on certain data types such as Enums. It is triggered when an attacker can supply or influence template text processed by Qute, for example user-controlled templates or template expressions used to generate HTML pages or emails; the CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network reachability, low complexity, and only low privileges required. A successful attacker gains remote code execution and can take control of the server, with high impact on confidentiality, integrity, and availability. Any application built on Quarkus that renders Qute templates with attacker-influenced content is affected; the source data does not enumerate affected version ranges, which are available in the Red Hat advisory. Exploitation has not been reported: no public proof-of-concept is known, the flaw is not in CISA's KEV, and EPSS estimates only about a 0.5% probability of exploitation within 30 days (41st percentile).

What to do: Upgrade Quarkus and any Red Hat builds of Quarkus (including the bundled Qute engine) to the fixed releases identified in the Red Hat security advisory, since the source data does not list specific version numbers. Until patched, avoid letting users supply or modify Qute template text or template expressions, and consider restricting or disabling the ReflectionValueResolver for templates that process untrusted input. Audit applications for places where template content is dynamic or user-driven, such as HTML page or email generation, as those are the exploitable code paths.