CVE-2026-66089 Details
Description
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).
A XML External Entity (XXE) vulnerability has been identified in openEQUELLA versions prior to 2026.1.0. The issue resides in the SOAP API, specifically within the stopEdit operation, which parses XML with external entity resolution enabled. This vulnerability allows unauthenticated remote attackers to read arbitrary files accessible to the openEQUELLA service or to conduct server-side request forgery (SSRF) attacks by directing the server to make requests to specified locations.
Users can upgrade to openEQUELLA version 2026.1.0 or later, with the latest 2026.1.x release recommended. This update disables the SOAP API by default and hardens the XML parser to reject external entities and document type declarations. If the SOAP API is not needed, it is advisable to keep the soapapi.enabled property unset or set to false. For those who cannot upgrade, access to SOAP endpoints under /services/ should be blocked at the network level, allowing only the SoapHarvesterService endpoint if harvesting integrations are in use.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openequella/openEQUELLA/security/advisories/GHSA-f9wv-5rpf-rq45 | MON-CSIRT | AdvisoryRemedyVendor |
| https://openequella.github.io/guides/ | MON-CSIRT | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-611 | Improper Restriction of XML External Entity Reference | MON-CSIRT |
Affected Products
| Product | Versions |
|---|---|
| openEQUELLA | < 2026.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | MON-CSIRT |