The solution for returning SOAP header described here: http://cxf.apache.org/faq.html (Question: How can I add soap headers to the request/response?). However it does not work with SOAP faults.
I'm using binding server (so not @WebServiceProvider but @WebService). Please see attached test case for more details. I believe it's due to below code snippet of JAXWSMethodInvoker.java class:
As SOAP headers are copied within the function updateWebServiceContext() but it is only called in success scenario and all stuff is cleared in finally block so in case of a fault, the headers are lost.