CVE-2026-11561: SSTI in Soagen Informatics' Apinizer

Synopsis

A server-side template injection (SSTI) vulnerability, technically an expression language injection, affects Apinizer by Soagen Informatics Technologies in versions 2026.04.0 through 2026.04.5. The flaw is reachable over the network without any authentication or user interaction, meaning an unauthenticated remote attacker can send a crafted request directly to the service. Successful exploitation enables arbitrary code execution on the host, giving the attacker full read, write, and availability impact. A patched-image rebuild at version 2026.04.6 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Apinizer service over the network; there is no requirement for local access or physical proximity (AV:N).

• AuthenticationNot required

  No account or credential of any privilege level is needed to trigger the vulnerability (PR:N).

• Victim interactionNot required

  The attacker does not need a victim to click a link, open a file, or take any other action; exploitation is fully attacker-driven (UI:N).

• Attack complexityDetail

  Exploit conditions are reliable and free of race conditions or environmental dependencies; a well-formed malicious request is sufficient (AC:L).

Blast Radius

• A successful attacker executes arbitrary code in the context of the Apinizer process, gaining a foothold on the host.
• All data accessible to Apinizer, including API configurations, credentials, proxied payloads, and stored secrets, can be read in full.
• The attacker can modify or delete Apinizer configuration, proxied data, or files writable by the process.
• The attacker can crash or hang the Apinizer service, disrupting API gateway availability for all consumers routed through it.