CVE-2026-100227

Summary

The flaw allows attackers to bypass XML signature verification by wrapping signed documents with unsigned content, potentially leading to unauthorized data processing. This occurs because the JAX-RS XML Security interceptors fail to ensure that all XML content passed to applications is actually covered by the signature.

Exploitability

Exploitation requires an attacker to have access to a document signed by a trusted key and the ability to wrap it with unsigned content, making it moderately difficult but possible to exploit.

Blast radius

If exploited, this vulnerability could allow attackers to process unsigned XML content as if it were signed, potentially leading to unauthorized data manipulation or processing in applications that rely on XML signatures for security.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache CXF versions 4.2.4, 4.1.9, or 3.6.13 which contain the fix for this signature verification issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.