CVE-2026-100227: XML signature wrapping bypass

CISO Take

Apache CXF's JAX-RS XML Security module fails to verify that the XML handed to the application is actually the content covered by the signature, enabling classic XML signature wrapping: an attacker holding any document signed by a trusted key can wrap it in unsigned, attacker-controlled content that the application treats as authentic. This is a generic Java web-services library flaw rather than an AI-specific one, and it only matters to AI/ML estates that use CXF JAX-RS XML Signature for signed requests, such as model-serving gateways, data-ingestion endpoints or SAML-style integrations. No CVSS, EPSS, KEV or public exploit data is available yet, so urgency should be driven by whether you use these interceptors, and exploitation requires only a previously signed legitimate document. Inventory CXF usage via SBOM and upgrade to 4.2.4, 4.1.9 or 3.6.13, then review any code paths that trust signed XML for authorization or data-integrity decisions.

Sources:NVDlists.apache.orgATLAS

What is the risk?

Risk is moderate pending a CVSS score. Exploitation is low-complexity once the attacker has any validly signed document, and it can defeat integrity and authenticity guarantees. There is no KEV listing, no public exploit and no EPSS data. Exposure is limited to services using the JAX-RS XmlSigInHandler, XmlSigInInterceptor or streaming XmlSecInInterceptor. The AI relevance is indirect and depends on whether AI/ML services rely on these components.

How does the attack unfold?

Initial Access

Attacker obtains any document signed by a trusted key and identifies a CXF JAX-RS endpoint verifying XML signatures.

AML.T0049

Exploitation

Attacker wraps the signed document in unsigned malicious content so the interceptor validates the signature without binding it to the processed XML.

Impact

The application treats forged XML as authentic, compromising integrity of data or commands feeding AI/ML services.

Initial Access

Attacker obtains any document signed by a trusted key and identifies a CXF JAX-RS endpoint verifying XML signatures.

AML.T0049

Exploitation

Attacker wraps the signed document in unsigned malicious content so the interceptor validates the signature without binding it to the processed XML.

Impact

The application treats forged XML as authentic, compromising integrity of data or commands feeding AI/ML services.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

IHigh

ANone

What should I do?

1 step

Upgrade Apache CXF to 4.2.4, 4.1.9 or 3.6.13. Identify affected services by searching dependencies for cxf-rt-rs-security-xml and for use of XmlSigInHandler, XmlSigInInterceptor and XmlSecInInterceptor. Until patched, enforce application-level checks that the signed element is the one actually processed, for example by validating the signature reference against the element consumed, and apply strict XML schema validation that rejects unexpected wrapper elements. Monitor for messages with signed elements in unexpected positions or extra unsigned siblings. Review the Apache mailing list advisory for further guidance.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassSupply ChainAPIFrameworkAML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Mechanisms to respond to and recover from unknown risks

Frequently Asked Questions

What is CVE-2026-100227?

Apache CXF's JAX-RS XML Security module fails to verify that the XML handed to the application is actually the content covered by the signature, enabling classic XML signature wrapping: an attacker holding any document signed by a trusted key can wrap it in unsigned, attacker-controlled content that the application treats as authentic. This is a generic Java web-services library flaw rather than an AI-specific one, and it only matters to AI/ML estates that use CXF JAX-RS XML Signature for signed requests, such as model-serving gateways, data-ingestion endpoints or SAML-style integrations. No CVSS, EPSS, KEV or public exploit data is available yet, so urgency should be driven by whether you use these interceptors, and exploitation requires only a previously signed legitimate document. Inventory CXF usage via SBOM and upgrade to 4.2.4, 4.1.9 or 3.6.13, then review any code paths that trust signed XML for authorization or data-integrity decisions.

Is CVE-2026-100227 actively exploited?

No confirmed active exploitation of CVE-2026-100227 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-100227?

Upgrade Apache CXF to 4.2.4, 4.1.9 or 3.6.13. Identify affected services by searching dependencies for cxf-rt-rs-security-xml and for use of XmlSigInHandler, XmlSigInInterceptor and XmlSecInInterceptor. Until patched, enforce application-level checks that the signed element is the one actually processed, for example by validating the signature reference against the element consumed, and apply strict XML schema validation that rejects unexpected wrapper elements. Monitor for messages with signed elements in unexpected positions or extra unsigned siblings. Review the Apache mailing list advisory for further guidance.

What systems are affected by CVE-2026-100227?

This vulnerability affects the following AI/ML architecture patterns: Model serving gateways, Data ingestion pipelines, Java-based API integrations.

What is the CVSS score for CVE-2026-100227?

CVE-2026-100227 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

Model serving gatewaysData ingestion pipelinesJava-based API integrations

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to the application was covered by the signature. An attacker with any document signed by a trusted key could wrap it in unsigned content, which the application would then treat as signed. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Exploitation Scenario

An attacker obtains a legitimately signed XML document from a trusted partner, for example a signed data-feed manifest or an API request. They embed it inside an attacker-crafted wrapper containing unsigned malicious elements. The CXF interceptor reports the signature as valid without confirming the processed XML is covered by it. The AI data-ingestion or model-serving service then accepts the attacker-controlled content as authenticated, enabling data injection into a pipeline or unauthorized operations.