CVE-2026-40997: SOAP security faults leak Spring Security account state
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure SOAP authentication/authorization failures are handled generically so Spring Security account state (e.g., locked/disabled user semantics) is not surfaced to remote SOAP clients via exception messages or callback outcomes.
Spring Web Services (Spring WS) with Spring Security integration Exception handling / authentication error responses for remote SOAP clients = Return generic authentication failures instead of exception messages or callback outcomes that reveal locked/disabled semantics
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40997?
The severity of CVE-2026-40997 is classified as medium with a score of 5.3.
What does CVE-2026-40997 exploit?
CVE-2026-40997 exploits vulnerabilities in Spring WS integration paths that can leak detailed account state information to remote SOAP clients.
How can organizations mitigate CVE-2026-40997?
Organizations can mitigate CVE-2026-40997 by ensuring that Spring Security configurations do not expose sensitive account state information in error messages.
What types of information could be leaked by CVE-2026-40997?
CVE-2026-40997 could leak sensitive information such as whether user accounts are locked or disabled through detailed exception messages.
Which software is affected by CVE-2026-40997?
CVE-2026-40997 affects applications that use Spring Web Services alongside Spring Security.