Spring WS SSRF via Unvalidated WS-Addressing Headers

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Casky was already ahead

This CVE exploits attack patterns that Casky's 312matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability is a Server-Side Request Forgery (SSRF) flaw in Spring Web Services that allows attackers to manipulate WS-Addressing ReplyTo and FaultTo headers to force the application into initiating outbound connections to arbitrary destinations. The vulnerability exists because Spring WS processes these headers without validating whether the specified destinations are trusted or safe to connect to. This affects multiple versions across all supported release lines (3.1.x through 5.0.x), making it a widespread risk for organizations using Spring WS for SOAP-based web services. The impact is severe: attackers can leverage this to scan internal networks, access cloud metadata endpoints, exfiltrate data through forced connections, or pivot to backend systems—all initiated from what appears to be a legitimate application server.

Casky's 312 matched skills detect the attack patterns behind this SSRF vulnerability by mapping to Initial Access (TA0001) and Credential Access (TA0006) MITRE ATT&CK techniques. Practitioners using Casky would see findings revealing malicious WS-Addressing header manipulation attempts, outbound connection attempts to suspicious or internal IP ranges, and patterns consistent with reconnaissance (scanning for open ports and services). The platform's Claude AI-powered extended reasoning identifies the attack chain: a practitioner might observe unusual outbound SOAP requests to RFC 1918 addresses, cloud metadata service endpoints (169.254.169.254), or external command-and-control servers initiated from application logs. By correlating these connection attempts with suspicious WS-Addressing headers in request payloads, Casky enables security teams to distinguish legitimate web service calls from exploitation attempts and quickly identify which endpoints are being targeted for lateral movement or data exfiltration.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

312 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-40999.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-40999

Casky has 312 skills that investigate the attack patterns behind CVE-2026-40999. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn