CVE-2026-123753
Received Received - Intake

SSRF Vulnerability in Apache Axis2/Java

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: Apache Software Foundation

Description
Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-123753
EUVD
EUVD-2026-119936

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Axis2/Java From 0 (inc) to 2.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-123753 is a Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java affecting versions before 2.0.2. An unauthenticated attacker can supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, causing Axis2 to open a connection to that address to deliver responses or faults. This allows requests to internal hosts and enables response content to be sent to a host chosen by the attacker.

Detection Guidance

To detect this SSRF vulnerability in Apache Axis2/Java, check if your system is running versions before 2.0.2. Use commands like 'curl -s http://your-server/axis2/services/listServices | grep version' or inspect the Axis2/Java installation directory for version files. Monitor network traffic for unexpected outbound connections to internal or external hosts triggered by WS-Addressing ReplyTo/FaultTo headers.

Impact Analysis

This vulnerability allows attackers to make requests to internal hosts and exfiltrate data to external servers of their choice. It could lead to unauthorized access to sensitive systems, data leakage, or further attacks on internal networks. Systems using affected versions of Apache Axis2/Java are at risk until upgraded to version 2.0.2 or later.

Compliance Impact

This SSRF vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations using vulnerable versions may face compliance violations, data breach notifications, and potential fines if sensitive data is exposed through this flaw.

Mitigation Strategies

Upgrade Apache Axis2/Java to version 2.0.2 or later immediately. If upgrading is not possible, disable decoupled responses by setting allowNonAnonymousResponseEndpoints to false in the configuration. Restrict response endpoints by scheme and screen addresses at multiple layers to block private, loopback, and link-local destinations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123753. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...