CVE-2026-123766 · Runtime
NO FIX YET · SEE WHAT TO DO
The OpenAPI module of Apache Axis2/Java writes a value taken from the request's Host header into the Swagger UI page without encoding it. An attacker can get script to run in the browser of a user visiting the Axis2 origin.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only deployments running Apache Axis2/Java 2.0.1 with the OpenAPI module serving its Swagger UI page are exposed. Installations on other versions or without that module are not described as affected.
Not affected if default-config
Who cares apache-axis2, java, web-services
2.0.1 is affected.2.0.2Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injection in the context of the Axis2 origin. This issue affects Apache Axis2/Java: 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.