CVE-2026-100227 Apache CXF: XML Signature wrapping in JAX-RS XML Security
Attackers can bypass XML signature verification in Apache CXF by wrapping signed documents in unsigned content, tricking applications into trusting malicious data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100227?
CVE-2026-100227 is a high-severity vulnerability in Apache Cxf, published on 9 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to the application was covered by the signature. An attacker with any document signed by a trusted key could wrap it in unsigned content, which the application would then treat as signed. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Weakness: CWE-362
Which versions are affected by CVE-2026-100227?
It affects 1 product.
Products include Apache Cxf.
How do I fix CVE-2026-100227?
Upgrade to a fixed version.
Is CVE-2026-100227 being exploited?
There is no known exploitation of CVE-2026-100227 in the wild and no public exploit code.
Other vulnerabilities in Apache Cxf
- CVE-2012-2379 XML Signature/Encryption Not Validated in Apache CXF
- CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
- CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
- CVE-2026-50628 Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
- CVE-2025-48913 Apache CXF: Untrusted JMS configuration can lead to RCE
Sources
Also known as CLEANSTART-2026-JA94279, GHSA-m89p-3qw6-fh4r.