CVE-2026-87830

Analyzed Analyzed - Analysis Complete

StAX WS-SecurityPolicy XPath Validation Bypass

Publication date: 2026-09-30

Last updated on: 2026-10-06

Assigner: Apache Software Foundation

Description

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-87830

EUVD

EUVD-2026-89792

Affected Vendors & Products

Vendor	Product	Version / Range
apache	wss4j	to 2.4.4 (exc)
apache	wss4j	From 3.0.0 (inc) to 3.0.6 (exc)
apache	wss4j	From 4.0.0 (inc) to 4.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-917	The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Attack-Flow Graph

Executive Summary

This vulnerability involves the StAX streaming WS-SecurityPolicy validator incorrectly handling certain XPath expressions. It allows a remote SOAP peer to send a required XML element without proper signature or encryption by exploiting path mismatches in validation.

Detection Guidance

This vulnerability involves improper handling of XPath expressions in WS-SecurityPolicy validation. Detection requires checking for SOAP messages with relative or unsupported XPath expressions that bypass signature or encryption requirements. Inspect XML/SOAP traffic for malformed or unexpected XPath usage in WS-SecurityPolicy headers.

Impact Analysis

An attacker could bypass security checks by sending unsigned or unencrypted data in SOAP messages, potentially leading to unauthorized access or data tampering. Systems relying on WS-SecurityPolicy for message integrity may be compromised.

Compliance Impact

This vulnerability may violate compliance requirements that mandate encryption or signing of sensitive data, such as GDPR's data integrity principles or HIPAA's security rules for protected health information.

Mitigation Strategies

Upgrade to Apache StAX streaming WS-SecurityPolicy validator versions 4.0.2, 3.0.6, or 2.4.4 to fix the issue.

Hi! I’m here to help you understand CVE-2026-87830. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70