CVE-2026-123753 · Runtime
NO FIX YET · SEE WHAT TO DO
Axis2 opened connections to caller-supplied WS-Addressing ReplyTo or FaultTo addresses to deliver responses, without authentication. An unauthenticated attacker can make the server request internal hosts and push response content to a host of their choice.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Services built on Apache Axis2/Java that accept SOAP requests with WS-Addressing headers from callers. Decoupled responses are refused from 2.0.2 unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened. Systems on Axis2 2.0.2 or later are not affected by this issue.
Not affected if non-soap-service, version-2.0.2-or-later
Who cares apache-axis2, java, soap, web-services
2.0.1 are affected.allowNonAnonymousResponseEndpoints in the Axis2 configuration; the sources do not say what its default is.2.0.2.Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.