Description

A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-11T14:17:36.847Z",
  "pubdate": "2026-09-11T14:17:36.847Z",
  "executiveSummary": "A critical XML External Entity (XXE) vulnerability exists within the Akana API Platform, stemming from improper restriction of XML references during the XML-to-JSON transformation process.\nThe vulnerability allows remote, unauthenticated attackers to supply crafted XML input containing malicious entity references, which the XML parser then processes.\nSuccessful exploitation facilitates unauthorized access to sensitive local files, server-side request forgery (SSRF), and potential denial-of-service conditions by exhausting system resources.\nAffected versions include Akana 2026.1, 2025.1.1, and all versions prior to 2024.1.6.\nThe risk is significant due to the potential for data exfiltration and deeper internal network reconnaissance, necessitating immediate patching of all exposed API gateways and integration services.",
  "technicalDetails": "The vulnerability resides in the core XML parsing logic utilized by the Akana API Platform, specifically during the pipeline phase where XML payloads are converted into JSON format.\nThe root cause is a failure to properly configure the XML parser to disable the processing of external entities or Document Type Definitions (DTDs). By default, if the underlying parser is not explicitly hardened, it will resolve and attempt to dereference entities defined within the doctype declaration of an XML document.\nAn attacker can exploit this by injecting a malicious payload into an API request body. The payload includes a DOCTYPE definition containing an external entity reference targeting a local file (e.g., file:///etc/passwd) or an internal network resource (e.g., http://internal-service/admin).\nWhen the Akana platform processes this XML during the transformation sequence, the parser dereferences the entity, effectively causing the application to include the contents of the target file or the response from the internal network resource within the generated output or memory state.\nThis behavior facilitates the following attack flow: 1) The attacker crafts an XML request with an external entity reference. 2) The request is submitted to the Akana API endpoint. 3) The platform's XML parser interprets the entity and attempts to fetch the target URI. 4) The platform inadvertently exposes the file contents or network metadata in the resulting API response or internal logs, bypassing authentication controls as the platform acts as the initiator of the request.\nThe impact extends beyond mere information disclosure; an attacker can leverage this primitive to conduct port scanning of internal infrastructure or execute local file inclusion (LFI) attacks. Given that the platform frequently handles high-trust traffic, this vulnerability compromises the integrity of the data processing pipeline and the confidentiality of sensitive local configuration files or credentials residing on the host system.\nThe vulnerability affects Akana 2026.1, 2025.1.1, and all iterations prior to 2024.1.6. Remediation requires upgrading to the latest patched release to ensure the parser is configured with secure defaults, specifically disabling DTDs and external entity substitution."
}