CVE-2026-47892

Sentinel/Defender KQL

let PreflightRequests = HttpRequests
| where Url contains "/" // Adjust to specific WebFlux functional endpoint paths if known
| where HttpMethod == "OPTIONS"
| where RequestHeaders contains "Access-Control-Request-Headers" and RequestHeaders contains "Access-Control-Request-Method";
PreflightRequests
| where ResponseStatus == 200 // Successful pre-flight
| join kind=inner (HttpRequests
    | where HttpMethod != "OPTIONS"
    | where Url contains "/" // Same endpoint path as pre-flight
    | where TimeGenerated > ago(1m) and TimeGenerated < now() // Follow-up request shortly after pre-flight
) on RemoteIp, UserAgent, Url
| where RequestHeaders contains "" // Look for unusual or missing headers that should be present based on the pre-flight
| project TimeGenerated, RemoteIp, UserAgent, Url, HttpMethod, RequestHeaders, ResponseStatus, CorrelationId

Splunk SPL

sourcetype=web_access_logs (method=OPTIONS AND uri="/*" AND header_access_control_request_headers=* AND header_access_control_request_method=*) OR (method!=OPTIONS AND uri="/*")
| transaction clientip, uri maxspan=1m keepevicted=true
| where mvcount(method) > 1 AND mvindex(method,0)="OPTIONS" AND mvindex(method,1)!="OPTIONS"
| eval preflight_headers = mvindex(header_access_control_request_headers,0)
| eval actual_headers = mvindex(request_headers,1)
| where NOT match(actual_headers, preflight_headers) // Simplified check, needs refinement based on specific bypass patterns
| table _time, clientip, uri, method, preflight_headers, actual_headers

Sigma

title: Spring Framework WebFlux Header Predicate Bypass Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential attempts to bypass header predicates in Spring WebFlux applications using functional endpoints and DispatcherServlet via pre-flight requests.
references:
  - https://spring.io/security/cve-2026-47892
logsource:
  category: webserver
  product: spring_webflux
detection:
  selection_preflight:
    cs-method: 'OPTIONS'
    cs-uri-stem|contains: '/'
    cs-header-Access-Control-Request-Headers|exists: true
    cs-header-Access-Control-Request-Method|exists: true
  selection_followup:
    cs-method|!in: ['OPTIONS']
    cs-uri-stem|contains: '/'
  condition: selection_preflight and selection_followup
  timeframe: 1m
  # Further refinement needed to compare headers between pre-flight and follow-up
  # This requires advanced correlation capabilities not directly expressible in basic Sigma
falsepositives:
  - Legitimate pre-flight requests followed by valid requests.
level: high

Elastic ES|QL

from logs-webserver-access.*
| where http.request.method == 'OPTIONS' and url.path.keyword : '*' and http.request.headers."access-control-request-headers" : '*' and http.request.headers."access-control-request-method" : '*'
| keep @timestamp, source.ip, user_agent.original, url.path.keyword, http.request.method, http.request.headers
| join (from logs-webserver-access.*
    | where http.request.method != 'OPTIONS' and url.path.keyword : '*'
    | keep @timestamp, source.ip, user_agent.original, url.path.keyword, http.request.method, http.request.headers
) on source.ip, user_agent.original, url.path.keyword
| where @timestamp.x - @timestamp.y < 60000 // Follow-up within 60 seconds
| eval preflight_headers = http.request.headers.x."access-control-request-headers"
| eval actual_headers = http.request.headers.y
| where NOT (actual_headers : preflight_headers) // Simplified check, needs refinement
| project @timestamp.x, source.ip, user_agent.original, url.path.keyword, http.request.method.x, preflight_headers, http.request.method.y, actual_headers