Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-12894
Quarkus quarkus-qute — Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L L N U H H H 8.8 .0051 42.0 —
AFFECTED
Product Versions Fixed
quarkus-qute 3.27.0 – —
Red Hat Build of Apache Camel 3.33.3.SP1 unspecified 3.33.3.redhat-00005
Red Hat build of Quarkus 3.27.5.SP1 unspecified —
Red Hat build of Quarkus 3.33.3.SP1 unspecified —
Red Hat build of Apache Camel 4 for Quarkus 3 unspecified —
Red Hat build of Apache Camel 4 for Quarkus 3 unspecified —
Red Hat build of Apache Camel 4 for Quarkus 3 unspecified —
Red Hat JBoss Enterprise Application Platform Expansion Pack unspecified —
Red Hat JBoss Enterprise Application Platform Expansion Pack unspecified —
Red Hat JBoss Enterprise Application Platform Expansion Pack unspecified —
TIMELINE
Jun 22 Reserved by redhat
Aug 31 Published (CNA: redhat)
Oct 11 PATCH SHIPPED — CVE-2026-12894 (quarkus-qute). Fixed in Red Hat Build of Apache Camel 3.33.3.SP1 3.33.3.redhat-00005.
Description
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 22, 2026 | Reserved | Reserved by redhat |
| August 31, 2026 | Published | Published (CNA: redhat) |
| October 11, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-12894 (quarkus-qute). Fixed in Red Hat Build of Apache Camel 3.33.3.SP1 3.33.3.redhat-00005. |
Affected
Affected products and packages — 10 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Quarkus | quarkus-qute | — | 3.27.0 | — |
| Red Hat | Red Hat Build of Apache Camel 3.33.3.SP1 | — | — | 3.33.3.redhat-00005 |
| Red Hat | Red Hat build of Quarkus 3.27.5.SP1 | — | — | — |
| Red Hat | Red Hat build of Quarkus 3.33.3.SP1 | — | — | — |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | — | — | — |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | — | — | — |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | — | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-12894 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
