{"id":"CVE-2026-123753","kind":"vulnerability","aliases":["CVE-2026-123753"],"related":[],"title":"Apache Axis2/Java: SSRF via WS-Addressing reply address reaches internal hosts","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.","summary":"Axis2 opened connections to caller-supplied WS-Addressing ReplyTo or FaultTo addresses to deliver responses, without authentication. An unauthenticated attacker can make the server request internal hosts and push response content to a host of their choice.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-axis2","java","runtime","soap","web-services"],"not_affected_if":["non-soap-service","version-2.0.2-or-later"],"how_to_check":"- Check the Axis2/Java version in use; versions through `2.0.1` are affected.\n- Look for `allowNonAnonymousResponseEndpoints` in the Axis2 configuration; the sources do not say what its default is.","fix":"- Apache Axis2/Java: upgrade to `2.0.2`.","status":"open","published_at":"2026-11-09T11:17:23+00:00","first_seen_at":"2026-11-09T11:26:04+00:00","triaged_at":"2026-11-09T11:26:53+00:00","updated_at":"2026-11-09T11:26:53+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-09T11:26:53Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Axis2/Java: upgrade to `2.0.2`.","reach":"internet","title":"Apache Axis2/Java: SSRF via WS-Addressing reply address reaches internal hosts","impact":"medium","summary":"Axis2 opened connections to caller-supplied WS-Addressing ReplyTo or FaultTo addresses to deliver responses, without authentication. An unauthenticated attacker can make the server request internal hosts and push response content to a host of their choice.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-axis2","java","soap","web-services"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Server reaches internal hosts and forwards response content to attacker-chosen host","analyst_note":"Confirm the default of allowNonAnonymousResponseEndpoints and the exact advisory text from the NVD record and the Apache Axis2 announcement; the fix link is a GitHub patch page.","how_to_check":"- Check the Axis2/Java version in use; versions through `2.0.1` are affected.\n- Look for `allowNonAnonymousResponseEndpoints` in the Axis2 configuration; the sources do not say what its default is.\n- unknown for anything beyond the version check.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-2.0.2-or-later","non-soap-service"],"who_is_affected":"Services built on Apache Axis2/Java that accept SOAP requests with WS-Addressing headers from callers. Decoupled responses are refused from 2.0.2 unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened. Systems on Axis2 2.0.2 or later are not affected by this issue.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000815,"input_tokens":4729,"output_tokens":684,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123753':15A,18A '-2026':14A,17A '2.0.1':164C '2.0.2':129C,172C 'address':7A,9A,37B,41B,88C,94C,103C 'affect':160C 'allow':110C 'allownonanonymousresponseendpoint':135C 'anonym':85C 'apach':1A,20B,75C,161C 'apache-axis2':19B 'attack':49B 'authent':46B 'axis2':21B,28B,96C 'axis2/java':2A,76C,162C 'caller':33B,79C,125C 'caller-suppli':32B 'choic':66B 'choos':127C 'connect':30B,100C 'content':60B,119C 'could':80C 'cve':13A,16A 'decoupl':130C 'deliv':43B,105C 'deliveri':116C 'enabl':137C,139C 'endpoint':140C 'fault':109C 'faultto':40B,93C 'fix':174C 'forgeri':71C 'header':151C 'header-pars':150C 'host':12A,56B,63B,114C,122C 'intern':11A,55B,113C 'issu':159C,176C 'java':22B 'layer':157C 'make':51B 'non':84C 'non-anonym':83C 'open':29B,98C 'pars':152C 'push':58B 'reach':10A 'recommend':167C 'refus':133C 'repli':8A 'replyto':38B,90C 'request':54B,70C,111C 'respons':44B,59B,107C,118C,131C 'restrict':142C 'runtim':23B 'scheme':144C 'screen':146C 'select':156C 'server':53B,68C 'server-sid':67C 'servic':27B 'side':69C 'soap':24B 'ssrf':3A,72C 'suppli':34B,81C 'transport':155C 'transport-select':154C 'unauthent':48B,78C 'unless':134C 'upgrad':169C 'user':165C 'version':171C 'via':4A 'vulner':73C 'web':26B 'web-servic':25B 'without':45B 'would':97C 'ws':6A,36B,87C 'ws-address':5A,35B,86C 'wsa':89C,92C","nicknames":[],"mitigations":[],"who_affected":"Services built on Apache Axis2/Java that accept SOAP requests with WS-Addressing headers from callers. Decoupled responses are refused from 2.0.2 unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened. Systems on Axis2 2.0.2 or later are not affected by this issue.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheaxis2","java","runtime","soap","unknown","webservices"],"campaign_type":null,"search_a":"'-123753':15A,18A '-2026':14A,17A 'address':7A,9A 'apach':1A 'axis2/java':2A 'cve':13A,16A 'host':12A 'intern':11A 'reach':10A 'repli':8A 'ssrf':3A 'via':4A 'ws':6A 'ws-address':5A","search_b":"'address':37B,41B 'apach':20B 'apache-axis2':19B 'attack':49B 'authent':46B 'axis2':21B,28B 'caller':33B 'caller-suppli':32B 'choic':66B 'connect':30B 'content':60B 'deliv':43B 'faultto':40B 'host':56B,63B 'intern':55B 'java':22B 'make':51B 'open':29B 'push':58B 'replyto':38B 'request':54B 'respons':44B,59B 'runtim':23B 'server':53B 'servic':27B 'soap':24B 'suppli':34B 'unauthent':48B 'web':26B 'web-servic':25B 'without':45B 'ws':36B 'ws-address':35B","search_c":"'2.0.1':164C '2.0.2':129C,172C 'address':88C,94C,103C 'affect':160C 'allow':110C 'allownonanonymousresponseendpoint':135C 'anonym':85C 'apach':75C,161C 'axis2':96C 'axis2/java':76C,162C 'caller':79C,125C 'choos':127C 'connect':100C 'content':119C 'could':80C 'decoupl':130C 'deliv':105C 'deliveri':116C 'enabl':137C,139C 'endpoint':140C 'fault':109C 'faultto':93C 'fix':174C 'forgeri':71C 'header':151C 'header-pars':150C 'host':114C,122C 'intern':113C 'issu':159C,176C 'layer':157C 'non':84C 'non-anonym':83C 'open':98C 'pars':152C 'recommend':167C 'refus':133C 'replyto':90C 'request':70C,111C 'respons':107C,118C,131C 'restrict':142C 'scheme':144C 'screen':146C 'select':156C 'server':68C 'server-sid':67C 'side':69C 'ssrf':72C 'suppli':81C 'transport':155C 'transport-select':154C 'unauthent':78C 'unless':134C 'upgrad':169C 'user':165C 'version':171C 'vulner':73C 'would':97C 'ws':87C 'ws-address':86C 'wsa':89C,92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123753","severity":null,"published_at":"2026-11-09T11:17:23+00:00","modified_at":"2026-11-09T11:17:23+00:00","first_seen_at":"2026-11-09T11:26:04+00:00","fetched_at":"2026-11-09T11:26:04+00:00","note":null}],"documents":[{"id":107113,"url":"https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":107114,"url":"https://github.com/apache/axis-axis2-java-core/commit/1b6856b4d7903780786c79327bed1b53ea051a15","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}