CVE-2026-82558 Apache Software Foundation CVE debrief

Who should care

Defenders and developers using Apache Wicket, especially those with WebSocketBehavior implementations, should assess exposure and prioritize remediation due to potential unauthorized message receipt in Apache Wicket's WebSocketBehavior. They should verify WebSocketBehavior usage and component restrictions, and ensure that fixes are properly tested and verified.

Why it matters

Defenders should assess exposure and prioritize remediation due to potential unauthorized message receipt in Apache Wicket's WebSocketBehavior.

• Potential unauthorized message receipt
• Need to verify WebSocketBehavior usage and component restrictions
• Remediation priority for affected versions

Technical summary

Apache Wicket's WebSocketBehavior does not check authorization before invoking onMessage() callbacks, allowing unauthorized message receipt. This occurs when WebSocketBehavior is attached to a component that is hidden, disabled, or restricted through IAuthorizationStrategy. The issue affects multiple versions of Apache Wicket, including supported and unsupported releases. Defenders should assess exposure, prioritize remediation, and verify fixes. The vulnerability allows clients to receive messages intended for other users, potentially leading to unauthorized access.

Defensive priority

Defenders should assess exposure, prioritize remediation, and verify fixes.

Recommended defensive actions

• Assess exposure by checking if WebSocketBehavior is used with restricted components
• Prioritize remediation by upgrading to fixed versions
• Verify fixes by testing WebSocketBehavior functionality
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE and NVD records provide details on the vulnerability. Limited information is available on exploitation. The issue affects multiple versions of Apache Wicket, including supported and unsupported releases. Defenders should verify WebSocketBehavior usage and component restrictions. The CVE record was published on 2026-11-01T22:17:47.187Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.