CVE-2026-41000
Description
A flaw was found in Spring Web Services. The security interceptor in the affected component did not properly integrate replay cache mechanisms. This vulnerability could allow a remote attacker to bypass replay protections for security tokens, such as UsernameToken nonces and SAML one-time-use elements. The consequence is a low integrity impact, where an attacker might be able to reuse tokens for unauthorized actions.
Statement
Red Hat rates this vulnerability as Low impact with a CVSS score of 3.7, consistent with the upstream assessment. Attack Complexity is High (AC:H) because the attacker must first capture a valid SOAP message in transit and then replay it within the token acceptance window, which defaults to 300 seconds. Impact is limited to integrity (I:L), as a replayed message can only repeat an already-authorized operation with no effect on confidentiality or availability. Red Hat products that ship spring-ws-security, where the vulnerable Wss4jSecurityInterceptor resides, are limited to Red Hat Fuse 7. In Fuse deployments, this risk is further reduced when services enforce TLS for all SOAP endpoints, preventing the message capture that exploitation depends on.
Mitigation
Ensure all SOAP endpoints using Spring Web Services WS-Security are accessed exclusively over TLS. This prevents attackers from capturing valid SOAP messages in transit, which is a prerequisite for exploiting the replay cache bypass. Additionally, reduce the WSS4J timestamp acceptance window (timeToLive) from the default 300 seconds to the minimum value the application can tolerate, limiting the replay window for any messages that may be intercepted through other means.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
Messages sent with a capture-relay attack allow access to resources which are not otherwise accessible without proper authentication.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
