CVE-2026-89212
Akana API Platform has a critical flaw that lets attackers exploit XML external entity processing to read sensitive data. The issue affects several older versions and has been patched in the latest release. Users should update immediately.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Akana API Platform, versions 2026.1, 2025.1.1, and all releases before 2024.1.6, including unsupported older versions. Organizations running these versions are at risk.
Real-world impact
An attacker could send a crafted XML file to the platform and read arbitrary files on the server, potentially exposing confidential data or enabling further attacks.
Why this severity
The CVSS score of 9.2 reflects that the vulnerability can be exploited remotely without authentication, giving attackers high confidentiality impact and the ability to read files. The lack of required privileges and the potential for serious data exposure make it critical.
What to do about it
- 011. Update Akana API Platform to the latest supported release (2026.1 or newer).
- 022. Verify that the update includes the security patch for CVE-2026-89212.
- 033. Restart the Akana services to apply the changes.
NVD-referenced vendor advisory
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 11, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.