CVE-2026-12894: Quarkus Qute Template Engine RCE Vulnerability

CVE-2026-12894 Overview

CVE-2026-12894 is a sandbox bypass in the Qute template engine used by Quarkus to render dynamic content such as HTML pages and emails. The ReflectionValueResolver component fails to properly restrict access to sensitive Java internal methods when resolving values on certain data types, including Enums. An attacker who can supply or influence template content can invoke arbitrary reflective calls and execute unauthorized commands on the server. The flaw is tracked under CWE-1336 as an improper neutralization of special elements used in a template engine.

Critical Impact
Authenticated attackers with the ability to influence Qute template text can bypass reflection restrictions and achieve remote code execution on Quarkus applications.

Affected Products

Quarkus using the Qute template engine
Red Hat build of Quarkus (see Red Hat Security Advisory RHSA-2026:63302)
Applications embedding vulnerable versions of the ReflectionValueResolver component

Discovery Timeline

2026-08-31 - CVE-2026-12894 published to the National Vulnerability Database
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-12894

Vulnerability Analysis

Qute is Quarkus's server-side template engine. It resolves expressions such as {item.name} against a data model at render time. To locate a matching property or method, Qute delegates to ReflectionValueResolver, which uses Java reflection to find accessors on the target object.

The resolver enforces an allow/deny policy intended to block sensitive Java internals such as methods on java.lang.Class, ClassLoader, or Runtime. That policy is not applied consistently across all data types. When the target value is an Enum or another affected type, the resolver walks the reflected member set without applying the same restrictions used for standard objects. This allows a template expression to reach getClass(), class loader references, and further methods that lead to arbitrary command execution.

Successful exploitation gives the attacker code execution under the identity of the Quarkus process, resulting in loss of confidentiality, integrity, and availability of the host application and its data.

Root Cause

The root cause is incomplete enforcement of the reflection allowlist in ReflectionValueResolver. Sensitive Java methods are filtered for general object types but not for Enum-typed values and related resolution paths. This inconsistent filtering, categorized as [CWE-1336] Improper Neutralization of Special Elements Used in a Template Engine, permits an expression that would normally be blocked to resolve on an Enum instance.

Attack Vector

The attack requires network access to a Quarkus endpoint that renders Qute templates and low-privilege access sufficient to supply or influence template text. This includes applications that accept user-controlled template fragments, load templates from user-writable storage, or expose administrative template editors. No user interaction is required beyond triggering the template render.

Exploitation involves crafting a Qute expression that references an Enum value, chains through reflective accessors exposed by ReflectionValueResolver, and invokes a command execution primitive on the Java runtime. See the Red Hat CVE record for CVE-2026-12894 and Red Hat Bug Report #2491319 for vendor technical detail.

Detection Methods for CVE-2026-12894

Indicators of Compromise

Qute template expressions in logs or stored templates containing references to class, classLoader, getDeclaredMethods, Runtime, or ProcessBuilder.
Unexpected child processes spawned by the Quarkus JVM, such as /bin/sh, bash, curl, wget, or PowerShell.
Outbound network connections from the Quarkus process to unfamiliar hosts shortly after template rendering.
Errors in application logs referencing ReflectionValueResolver combined with Enum types or reflection failures.

Detection Strategies

Inspect stored templates and template inputs for reflective expressions targeting Enum values or java.lang.* members.
Correlate HTTP requests to template-rendering endpoints with process creation events on the host running Quarkus.
Alert on Quarkus JVM instances that execute shell interpreters or scripting engines, which are unusual for typical web workloads.

Monitoring Recommendations

Enable verbose logging for the Qute engine and forward events to a centralized analytics tier for review.
Monitor filesystem writes to template directories and any user-controlled path used as a template source.
Track egress connections from application servers and baseline them to detect post-exploitation callbacks.

How to Mitigate CVE-2026-12894

Immediate Actions Required

Apply the fixed Quarkus and Qute packages published in Red Hat Security Advisory RHSA-2026:63302.
Inventory all Quarkus applications and identify any that render templates sourced from user input or external storage.
Revoke or rotate secrets accessible to the Quarkus process if evidence of exploitation is found.
Restrict network access to administrative interfaces that permit template editing.

Patch Information

Red Hat has released updated packages addressing the flaw. Review Red Hat Security Advisory RHSA-2026:63302 and the Red Hat CVE page for CVE-2026-12894 for supported versions and upgrade paths. Upstream Quarkus users should upgrade to the release that includes the corrected ReflectionValueResolver filtering logic.

Workarounds

Treat all template content as trusted code and never render templates constructed from user input.
Load templates only from read-only, version-controlled locations that require code review to modify.
Run the Quarkus JVM under a least-privilege service account and restrict its ability to spawn child processes using operating-system controls such as seccomp, AppArmor, or SELinux.
Place a web application firewall in front of template-driven endpoints to block payloads containing reflective keywords such as class, classLoader, or Runtime.

bash

# Example: restrict the Quarkus service from spawning shells using systemd
# /etc/systemd/system/quarkus-app.service.d/hardening.conf
[Service]
NoNewPrivileges=true
SystemCallFilter=~@debug @mount @swap @reboot @raw-io
RestrictNamespaces=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true