CVE-2026-87718

Received Received - Intake

Content-Security-Policy Bypass in Apache Wicket

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Apache Software Foundation

Description

Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a request renders a page, so with a deeper chain, for example an application-provided delegating request mapper combined with CryptoMapper, the page is served without any CSP header even though CSP is enabled, and no error or warning is raised. The nonce-based protection Wicket applies to inline scripts and styles, together with any other CSP directives configured by the application, is thereby lost for those pages, exposing them to content injection the policy was meant to prevent. Applications on stock Wicket that do not wrap request handlers themselves are not affected. Versions before 10.10.0 and 9.24.0 handled nested delegates correctly. Users are recommended to upgrade to version 10.12.0 or 9.25.0, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-01

Last Modified

2026-11-01

Generated

2026-11-02

AI Q&A

2026-11-02

EPSS Evaluated

N/A

NVD

CVE-2026-87718

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache Wicket	9.24.0
Apache Software Foundation	Apache Wicket	10.10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

Apache Wicket versions 10.10.0, 10.11.0, and 9.24.0 fail to set Content-Security-Policy headers when a page's render request handler is wrapped in multiple IRequestHandlerDelegate layers. The framework only unwraps one delegate level, so deeper chains like an application-provided delegating request mapper combined with CryptoMapper result in pages served without CSP headers. This bypasses nonce-based protections for inline scripts and styles, removing safeguards against content injection attacks.

Detection Guidance

Check if Apache Wicket pages served without Content-Security-Policy headers by inspecting HTTP responses for missing CSP directives. Use browser developer tools or curl to verify headers on pages using nested IRequestHandlerDelegates.

Impact Analysis

This vulnerability exposes applications to content injection attacks, where malicious scripts or styles could be injected into pages that should have been protected by CSP headers. Attackers could exploit this to steal data, manipulate page content, or perform actions on behalf of users. Applications using nested request handler delegates are at risk.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing applications to content injection risks due to missing Content-Security-Policy headers. Without CSP headers, inline scripts and styles are vulnerable to injection attacks, which may violate data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade Apache Wicket to version 10.12.0 or 9.25.0 to fix the nested delegate handling issue. Review custom request handler wrappers to ensure CSP headers are applied correctly.

Hi! I’m here to help you understand CVE-2026-87718. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...