CVE-2026-123779: Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes

Summary by Cyber Security News6 Nov 2026, 19:30 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/562

Posted by Robert Lazarski on Nov 06 Severity: low Affected versions: - Apache Axis2/Java before 2.0.2 - Apache Axis2/Java before 2.0.2 Description: Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone HTTP server, the...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

CVE-2026-120832: Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution

CVE-2026-120367: Apache Axis2/Java: unbounded JSON request body buffering

CVE-2026-123770: Apache Axis2/Java: Unbounded multipart and form-encoded request bodies

CVE-2026-123766: Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page

CVE-2026-123753: Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints

CVE-2026-120761: Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documents