---
id: "CVE-2026-123753"
page: "https://infrastack.ai/live/CVE-2026-123753"
kind: "vulnerability"
aliases: ["CVE-2026-123753"]
title: "Apache Axis2/Java: SSRF via WS-Addressing reply address reaches internal hosts"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache-axis2", "java", "runtime", "soap", "web-services"]
not_affected_if: ["non-soap-service", "version-2.0.2-or-later"]
published_at: "2026-11-09T11:17:23+00:00"
first_seen_at: "2026-11-09T11:26:04+00:00"
updated_at: "2026-11-09T11:26:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123753", "first_seen_at": "2026-11-09T11:26:04+00:00"}]
exploit_sources: []
---

# Apache Axis2/Java: SSRF via WS-Addressing reply address reaches internal hosts

Link for people: https://infrastack.ai/live/CVE-2026-123753 (this .md is for agents)

Axis2 opened connections to caller-supplied WS-Addressing ReplyTo or FaultTo addresses to deliver responses, without authentication. An unauthenticated attacker can make the server request internal hosts and push response content to a host of their choice.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Axis2/Java version in use; versions through `2.0.1` are affected.
- Look for `allowNonAnonymousResponseEndpoints` in the Axis2 configuration; the sources do not say what its default is.

## Fix

- Apache Axis2/Java: upgrade to `2.0.2`.

## Timeline

- 2026-11-09T11:26:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123753

## Documents

- [fix] Patch: github.com https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117
- [fix] Patch: github.com https://github.com/apache/axis-axis2-java-core/commit/1b6856b4d7903780786c79327bed1b53ea051a15

## From the sources

Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_