CVE-2026-40999: Spring WS SSRF via unvalidated WS-Addressing reply destinations

Synopsis

Server-Side Request Forgery (SSRF) in Spring Web Services allows a remote, unauthenticated attacker to make the affected server initiate outbound HTTP connections to arbitrary destinations. The vulnerability is reachable over the network with no authentication required and no user interaction needed; an attacker supplies a malicious ReplyTo or FaultTo address in a WS-Addressing header, and Spring WS blindly follows it. Successful exploitation lets the attacker probe or interact with internal network resources that the server can reach, potentially exposing sensitive data from those internal services. Patched-image rebuilds at versions 3.1.9, 4.0.19, 4.1.4, and 5.0.2 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to send a crafted SOAP request over the network to the exposed Spring WS endpoint.

• AuthenticationNot required

  No credentials or session token are needed; the malicious WS-Addressing header is accepted from any unauthenticated request.

• Victim interactionNot required

  Exploitation is fully automated from the attacker side and requires no action from any user or operator on the target system.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and requires no special preconditions, race conditions, or knowledge of the target environment beyond a reachable endpoint.

Blast Radius

• The attacker can direct the server to issue outbound HTTP or HTTPS requests to arbitrary internal IP addresses or hostnames, effectively using the server as a proxy into the internal network.
• Internal services that trust requests from the application server (cloud metadata endpoints, internal APIs, database admin UIs) become reachable by the attacker without direct network access.
• Confidential data returned by those internal services, such as cloud instance credentials from metadata APIs or tokens from internal auth services, is exposed to the attacker via the forged reply path.
• Confidentiality impact is rated HIGH by the CVSS score; integrity and availability of the vulnerable service itself are not directly affected by this exploit path.