CVE-2026-89212

CVE-2026-89212 is an XML external entity (XXE) injection flaw (CWE-611) in the Akana API Platform, where external entity references are improperly restricted during XML-to-JSON processing. Because the affected path is reachable over the network without privileges, prior access, or user interaction (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N), an attacker can submit crafted XML containing external entity references to trigger the flaw. Successful exploitation yields high confidentiality impact on the vulnerable system and high subsequent-system confidentiality impact with low subsequent-system integrity impact (VC:H/SC:H/SI:L), consistent with reading local files or secrets from the platform and reaching internal resources via SSRF. All users of Akana API Platform versions 2026.1, 2025.1.1, and any version before 2024.1.6 — including older unsupported releases — are affected; a fix ships as a security patch in the latest release of each supported version line. There is no evidence of exploitation so far: the flaw is not in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade every Akana deployment to the latest patch release of its supported version line — at least 2024.1.6 if running 2024.1.x or older, and the newest 2025.1.x/2026.1.x patch releases otherwise — since unsupported older releases must be migrated to a supported line to receive the fix. Until patched, restrict or disable external entity resolution in the XML-to-JSON processing path, limit the platform's outbound network access to curb SSRF, and restrict which clients can submit XML payloads. Inventory all Akana gateway and portal instances, prioritizing those with XML endpoints exposed to the internet.