CVE-2026-32735: OpenAPI Java Records Mustache Vulnerability

CVE-2026-32735 Overview

CVE-2026-32735 is an Improper Input Validation vulnerability affecting the openapi-to-java-records-mustache-templates project, which allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file (openapi-to-java-records-mustache-templates-parent) uses maven-dependency-plugin to unpack arbitrary .mustache files from the openapi-to-java-records-mustache-templates artifact without following security best practices. While this parent POM file is not intended for external use, it is publicly published and could be used by anyone, creating a potential supply chain risk.

Critical Impact

If the openapi-to-java-records-mustache-templates artifact were compromised, malicious .mustache files could be automatically unpacked during a dependency update, potentially leading to supply chain attacks against downstream projects.

Affected Products

• openapi-to-java-records-mustache-templates versions 5.1.1 to 5.5.0
• openapi-to-java-records-mustache-templates-parent (all versions prior to v3.5.1)

Discovery Timeline

• 2026-03-18 - CVE-2026-32735 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-32735

Vulnerability Analysis

This vulnerability stems from an improper input validation issue (CWE-20) in the build configuration of the openapi-to-java-records-mustache-templates project. The parent POM file centralizes plugin configurations for multiple unit-test modules and utilizes the maven-dependency-plugin to automatically unpack .mustache template files from the main artifact during the build process.

The core issue is that the unpacking operation does not validate or sanitize the contents of the .mustache files being extracted. In a supply chain attack scenario, if an attacker could compromise the openapi-to-java-records-mustache-templates artifact (for example, through a compromised maintainer account or build pipeline), they could inject malicious template files that would be automatically distributed to all projects using the parent POM.

The vulnerability requires network access and some user interaction, as users must actively include the parent POM in their build configuration and trigger a dependency update. The direct impact is limited to downstream integrity effects rather than direct confidentiality or availability impacts on the vulnerable component itself.

Root Cause

The root cause is the use of maven-dependency-plugin to unpack arbitrary files from a dependency without proper validation or content verification. The parent POM file, although not intended for production use, is publicly published to Maven repositories, making it accessible to anyone who might unknowingly incorporate it into their build process. This violates the principle of least privilege and secure-by-default configuration in build pipelines.

Attack Vector

The attack vector is network-based but requires specific conditions to be exploited:

1. An attacker would first need to compromise the openapi-to-java-records-mustache-templates artifact through supply chain compromise
2. The attacker would inject malicious .mustache template files into the compromised artifact
3. Users who have configured their projects to use the parent POM would automatically download and unpack these malicious files during their next dependency update
4. The malicious templates could potentially affect code generation, introducing vulnerabilities or backdoors into generated Java code

The attack requires user participation in the form of including the parent POM and triggering builds, which limits the exploitability but still presents a significant supply chain risk for affected users.

Detection Methods for CVE-2026-32735

Indicators of Compromise

• Unexpected or modified .mustache files appearing in build directories after dependency updates
• Changes to generated Java Records that don't correspond to OpenAPI specification changes
• Unusual network activity during Maven builds pointing to unexpected artifact sources
• Hash mismatches for downloaded openapi-to-java-records-mustache-templates artifacts

Detection Strategies

• Review your pom.xml files for any references to openapi-to-java-records-mustache-templates-parent
• Implement artifact signature verification in your Maven configuration
• Monitor dependency updates using software composition analysis (SCA) tools
• Audit generated code for unexpected changes after dependency updates

Monitoring Recommendations

• Enable Maven artifact verification and signature checking in your CI/CD pipeline
• Implement dependency lock files to detect unexpected version changes
• Use SentinelOne Singularity Platform to monitor build systems for suspicious file operations
• Regularly audit build configurations for references to development-only or test-only parent POMs

How to Mitigate CVE-2026-32735

Immediate Actions Required

• Remove any references to openapi-to-java-records-mustache-templates-parent from production build configurations
• Upgrade to version v3.5.1 or later of the parent POM if it must be used for testing purposes
• Audit existing generated code for any unexpected modifications
• Review your dependency management practices for similar patterns

Patch Information

This vulnerability is addressed in the v3.5.1 release of openapi-to-java-records-mustache-templates-parent. The fix is tracked in GitHub Pull Request #534 and GitHub Pull Request #620. Users should upgrade to the patched version immediately. For complete details, refer to the GitHub Security Advisory GHSA-3hrg-hjvj-9v66 and the GitHub Release v3.5.1.

Workarounds

• Do not use the parent POM (openapi-to-java-records-mustache-templates-parent) for external or production use; it is intended only for internal testing and maintainability
• If you must use the templates, consume only the openapi-to-java-records-mustache-templates module directly without the parent POM
• Implement additional artifact verification in your build pipeline to detect tampering
• Consider vendoring the specific template files you need rather than relying on dynamic unpacking during builds

# Verify you are not using the vulnerable parent POM
grep -r "openapi-to-java-records-mustache-templates-parent" --include="pom.xml" .

# If found, remove the parent reference and upgrade to use the module directly
# Update your pom.xml to use only the main artifact at version 5.5.1 or later