{"id":"CVE-2026-120832","kind":"vulnerability","aliases":["CVE-2026-120832"],"related":[],"title":"Apache Axis2/Java: WSDL imports let attackers make the server send requests","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import locations and in xsd:import and xsd:include schemaLocations with no scheme or host restriction; the AAR and WAR deployment resolvers also passed absolute schema locations on to the network. An attacker who controls a WSDL or schema processed by an Axis2 application could therefore make the JVM send requests to arbitrary internal or external hosts. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.","summary":"Apache Axis2/Java fetches absolute URLs found in WSDL and schema imports without checking the scheme or host. An attacker who supplies a WSDL or schema that an Axis2 application processes can make the server send requests to internal or external hosts.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-axis2","java","package","soap","wsdl"],"not_affected_if":["no-axis2-wsdl-processing","trusted-wsdl-only"],"how_to_check":"- Check the Axis2 version in your build file or lib directory, for example `axis2-kernel` in `pom.xml` or `build.gradle`.\n- Look for applications that build client services from WSDL files with `ServiceClient`, `AxisService.createClientSideAxisService` or `WSDLToAxisServiceBuilder`.\n- Check whether the application accepts WSDL or schema content from untrusted sources.","fix":"- Apache Axis2/Java: upgrade to `2.0.2`","status":"open","published_at":"2026-11-09T11:17:21+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","triaged_at":"2026-11-09T11:26:55+00:00","updated_at":"2026-11-09T11:26:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T11:26:55Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Axis2/Java: upgrade to `2.0.2`","reach":"network","title":"Apache Axis2/Java: WSDL imports let attackers make the server send requests","impact":"medium","summary":"Apache Axis2/Java fetches absolute URLs found in WSDL and schema imports without checking the scheme or host. An attacker who supplies a WSDL or schema that an Axis2 application processes can make the server send requests to internal or external hosts.","audience":"developers","category":"package","nicknames":[],"who_cares":["apache-axis2","java","soap","wsdl"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"server sends requests to internal hosts on attacker's behalf","analyst_note":"Ask NVD or the Apache Axis2 advisory for the exact affected version range and any attack prerequisites.","how_to_check":"- Check the Axis2 version in your build file or lib directory, for example `axis2-kernel` in `pom.xml` or `build.gradle`.\n- Look for applications that build client services from WSDL files with `ServiceClient`, `AxisService.createClientSideAxisService` or `WSDLToAxisServiceBuilder`.\n- Check whether the application accepts WSDL or schema content from untrusted sources.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["trusted-wsdl-only","no-axis2-wsdl-processing"],"who_is_affected":"Applications built on Apache Axis2/Java up to and including 2.0.1 are exposed when they process a WSDL or schema that an attacker can influence. The AAR and WAR deployment resolvers are also affected when they handle absolute schema locations. Applications that only use fixed, trusted WSDL files, or that do not use these Axis2 code paths, are less exposed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00081,"input_tokens":4724,"output_tokens":676,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120832':14A,17A '-2026':13A,16A '2.0.1':160C '2.0.2':168C 'aar':114C 'absolut':28B,93C,121C 'affect':156C 'also':119C 'apach':1A,19B,25B,74C,157C 'apache-axis2':18B 'applic':53B,140C 'arbitrari':149C 'attack':6A,43B,129C 'axis2':20B,52B,77C,139C 'axis2/java':2A,26B,75C,158C 'axisservice.createclientsideaxisservice':87C 'built':78C 'check':37B 'control':131C 'could':141C 'cve':12A,15A 'deploy':117C 'descript':81C 'extern':64B,152C 'fetch':27B,91C 'fix':170C 'forgeri':70C 'found':30B 'host':41B,65B,111C,153C 'import':4A,35B,97C,102C 'includ':105C 'intern':62B,150C 'issu':155C,172C 'java':21B 'jvm':145C 'let':5A 'locat':98C,123C 'make':7A,56B,143C 'network':127C 'packag':22B 'pass':120C 'process':54B,136C 'recommend':163C 'request':11A,60B,69C,147C 'resolv':118C 'restrict':112C 'schema':34B,49B,122C,135C 'schemaloc':106C 'scheme':39B,109C 'send':10A,59B,146C 'server':9A,58B,67C 'server-sid':66C 'servic':80C 'servicecli':86C 'side':68C 'soap':23B 'ssrf':71C 'suppli':45B 'therefor':142C 'upgrad':165C 'url':29B,94C 'user':161C 'version':167C 'vulner':72C 'war':116C 'without':36B 'wsdl':3A,24B,32B,47B,84C,96C,133C 'wsdltoaxisservicebuild':89C 'xsd':101C,104C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Apache Axis2/Java up to and including 2.0.1 are exposed when they process a WSDL or schema that an attacker can influence. The AAR and WAR deployment resolvers are also affected when they handle absolute schema locations. Applications that only use fixed, trusted WSDL files, or that do not use these Axis2 code paths, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheaxis2","java","package","soap","unknown","wsdl"],"campaign_type":null,"search_a":"'-120832':14A,17A '-2026':13A,16A 'apach':1A 'attack':6A 'axis2/java':2A 'cve':12A,15A 'import':4A 'let':5A 'make':7A 'request':11A 'send':10A 'server':9A 'wsdl':3A","search_b":"'absolut':28B 'apach':19B,25B 'apache-axis2':18B 'applic':53B 'attack':43B 'axis2':20B,52B 'axis2/java':26B 'check':37B 'extern':64B 'fetch':27B 'found':30B 'host':41B,65B 'import':35B 'intern':62B 'java':21B 'make':56B 'packag':22B 'process':54B 'request':60B 'schema':34B,49B 'scheme':39B 'send':59B 'server':58B 'soap':23B 'suppli':45B 'url':29B 'without':36B 'wsdl':24B,32B,47B","search_c":"'2.0.1':160C '2.0.2':168C 'aar':114C 'absolut':93C,121C 'affect':156C 'also':119C 'apach':74C,157C 'applic':140C 'arbitrari':149C 'attack':129C 'axis2':77C,139C 'axis2/java':75C,158C 'axisservice.createclientsideaxisservice':87C 'built':78C 'control':131C 'could':141C 'deploy':117C 'descript':81C 'extern':152C 'fetch':91C 'fix':170C 'forgeri':70C 'host':111C,153C 'import':97C,102C 'includ':105C 'intern':150C 'issu':155C,172C 'jvm':145C 'locat':98C,123C 'make':143C 'network':127C 'pass':120C 'process':136C 'recommend':163C 'request':69C,147C 'resolv':118C 'restrict':112C 'schema':122C,135C 'schemaloc':106C 'scheme':109C 'send':146C 'server':67C 'server-sid':66C 'servic':80C 'servicecli':86C 'side':68C 'ssrf':71C 'therefor':142C 'upgrad':165C 'url':94C 'user':161C 'version':167C 'vulner':72C 'war':116C 'wsdl':84C,96C,133C 'wsdltoaxisservicebuild':89C 'xsd':101C,104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120832","severity":null,"published_at":"2026-11-09T11:17:21+00:00","modified_at":"2026-11-09T11:17:21+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","fetched_at":"2026-11-09T11:26:03+00:00","note":null}],"documents":[{"id":107112,"url":"https://github.com/apache/axis-axis2-java-core/commit/7ac84d8339ad80f8f7f7977cf0caaa28fc3b7b98","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}