CVE-2026-40994: Spring Web Services Info Disclosure Flaw

CVE-2026-40994 Overview

CVE-2026-40994 affects Spring Web Services in how Wss4jSecurityInterceptor initializes its WS-I Basic Security Profile (BSP) compliance flag. The interceptor disables WSS4J BSP enforcement on the RequestData used during inbound validation. Services that validate WS-Security on the network can therefore accept SOAP messages that violate BSP rules. The defect weakens protocol-level checks intended to ensure interoperable, secure WS-Security message handling. The Common Weakness Enumeration classifies this issue under [CWE-1188] (Initialization of a Resource with an Insecure Default).

Critical Impact
Inbound WS-Security validation accepts non-compliant messages, allowing attackers to bypass BSP-mandated integrity protections on SOAP services.

Affected Products

Spring Web Services 5.0.0 through 5.0.1
Spring Web Services 4.1.0 through 4.1.3
Spring Web Services 4.0.0 through 4.0.18
Spring Web Services 3.1.0 through 3.1.8

Discovery Timeline

2026-06-11 - CVE-2026-40994 published to NVD
2026-06-11 - Last updated in NVD database

Technical Details for CVE-2026-40994

Vulnerability Analysis

The vulnerability resides in Wss4jSecurityInterceptor, the Spring Web Services component responsible for applying WSS4J-based WS-Security validation to inbound SOAP messages. During initialization, the interceptor sets the BSP compliance flag on the WSS4J RequestData instance to a value that disables WS-I Basic Security Profile enforcement. WSS4J normally rejects messages whose security headers violate BSP rules, such as disallowed token types, weak algorithms, or incorrect element ordering. With enforcement disabled, those checks are skipped during validation. Attackers can craft SOAP requests that include BSP-violating constructs and have them processed as valid. The impact is concentrated on message integrity assurances rather than confidentiality of stored data.

Root Cause

The root cause is an insecure default during interceptor initialization. The BSP compliance flag passed to the underlying RequestData object defaults to disabled rather than enabled, breaking the alignment with WSS4J's secure-by-default behavior. Because the flag governs how strictly inbound messages are validated, the misconfiguration silently weakens every endpoint relying on the affected interceptor.

Attack Vector

The attack vector is the network. An unauthenticated remote attacker submits SOAP requests to a service protected by the vulnerable Wss4jSecurityInterceptor. The malicious payload contains WS-Security headers that violate BSP requirements but remain syntactically processable by WSS4J. Because BSP enforcement is disabled, the service accepts the request and processes the underlying operation as if security validation had succeeded. No user interaction is required and no privileges are needed on the target. Refer to the Spring Security advisory for CVE-2026-40994 for vendor technical details.

Detection Methods for CVE-2026-40994

Indicators of Compromise

SOAP requests to WS-Security endpoints carrying tokens, algorithms, or header structures prohibited by WS-I Basic Security Profile.
Successful processing of messages that older or stricter WSS4J configurations would have rejected.
Unexpected client identities or message signatures appearing in WS-Security audit logs without corresponding BSP validation failures.

Detection Strategies

Inventory applications for Spring Web Services dependencies in the vulnerable version ranges using software composition analysis.
Inspect Wss4jSecurityInterceptor configuration to determine whether the BSP compliance flag is explicitly enabled.
Replay representative BSP-violating SOAP payloads against staging endpoints and confirm they are rejected after patching.

Monitoring Recommendations

Forward WSS4J and Spring Web Services logs to a centralized logging or SIEM platform and alert on validation anomalies.
Monitor SOAP traffic at the gateway for unusual WS-Security token types, signature algorithms, or header orderings.
Track outbound and inbound message volume on WS-Security endpoints for spikes that may indicate protocol abuse attempts.

How to Mitigate CVE-2026-40994

Immediate Actions Required

Upgrade Spring Web Services to a fixed release per the Spring advisory for the 3.1.x, 4.0.x, 4.1.x, and 5.0.x branches.
Audit every Wss4jSecurityInterceptor bean and explicitly enable BSP compliance on the configured RequestData.
Re-test SOAP services against BSP conformance suites after applying updates to confirm enforcement.

Patch Information

Pivotal Spring publishes fixed versions and configuration guidance in the Spring Security advisory for CVE-2026-40994. Apply the corresponding patched release for the branch in use: 5.0.x, 4.1.x, 4.0.x, or 3.1.x. Rebuild and redeploy any application packaging Spring Web Services as a bundled dependency.

Workarounds

Override the interceptor to explicitly enable BSP enforcement on RequestData before validation runs.
Deploy an API gateway or WS-Security proxy that rejects SOAP messages violating BSP rules before they reach Spring Web Services.
Restrict network exposure of affected SOAP endpoints to trusted clients until a patched build is in production.

bash

# Configuration example: enforce BSP compliance on Wss4jSecurityInterceptor
# Refer to the Spring advisory for the authoritative fix
# https://spring.io/security/cve-2026-40994