CVE-2021-40690: Bypass of the secureValidation property
Vulnerability summary
CVE-2021-40690 is a high (CVSS 7.5) vulnerability in apache software foundation apache santuario. EPSS estimates a 7.44% chance of exploitation in the next 30 days, higher than 94.4% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 7% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 3Timeline
- 19-09-2021PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
7.44%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
Increase +0.06 pp
From 7.38% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Oracle14 products
- agile_product_lifecycle_management9.3.6
- commerce_guided_search11.3.2
- commerce_platform11.3.2
- communications_diameter_intelligence_hub≥ 8.0.0, ≤ 8.1.0 | ≥ 8.2.0, ≤ 8.2.3
- communications_messaging_server8.1
Apache3 products
- cxf3.4.4
- santuario_xml_security_for_java< 2.1.7 | ≥ 2.2.0, < 2.2.3
- tomee< 8.0.8
Debian2 products
- libxml-security-java< 2.1.7-1 | < 2.0.10-2+deb10u1 | < 2.0.10-2+deb11u1 | < 1.5.8-2+deb9u1
- debian_linuxEOL9.0 | 10.0 | 11.0
Apache software foundation1 product
- apache santuario≥ XML Security for Java, < 2.2.3,2.1.7
Chainguard1 product
- elasticsearch-7< 7.17.14-r2
Org.apache.santuario1 product
- xmlsec≥ 2.2.0, < 2.2.3 | < 2.1.7
Ubuntu1 product
- libxml-security-java< 2.0.10-2~18.04.1 | < 2.0.10-2+deb11u1build0.20.04.1 | All versions (No fix recorded)
7 vendors · 23 products
References
29 links
lists.debian.org/debian-lts-announce/2021/09/msg00015.htmlMailing ListAdvisoryWEBThird Party Advisory
