CVE-2026-120832 · Package
NO FIX YET · SEE WHAT TO DO
Apache Axis2/Java fetches absolute URLs found in WSDL and schema imports without checking the scheme or host. An attacker who supplies a WSDL or schema that an Axis2 application processes can make the server send requests to internal or external hosts.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications built on Apache Axis2/Java up to and including 2.0.1 are exposed when they process a WSDL or schema that an attacker can influence. The AAR and WAR deployment resolvers are also affected when they handle absolute schema locations. Applications that only use fixed, trusted WSDL files, or that do not use these Axis2 code paths, are less exposed.
Not affected if no-axis2-wsdl-processing, trusted-wsdl-only
Who cares apache-axis2, java, soap, wsdl
axis2-kernel in pom.xml or build.gradle.ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder.Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import locations and in xsd:import and xsd:include schemaLocations with no scheme or host restriction; the AAR and WAR deployment resolvers also passed absolute schema locations on to the network. An attacker who controls a WSDL or schema processed by an Axis2 application could therefore make the JVM send requests to arbitrary internal or external hosts. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.0.2