{"id":"CVE-2026-123766","kind":"vulnerability","aliases":["CVE-2026-123766"],"related":[],"title":"Apache Axis2: Host header reflected into Swagger UI page enables script injection","description":"Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injection in the context of the Axis2 origin. This issue affects Apache Axis2/Java: 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.","summary":"The OpenAPI module of Apache Axis2/Java writes a value taken from the request's Host header into the Swagger UI page without encoding it. An attacker can get script to run in the browser of a user visiting the Axis2 origin.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-axis2","java","runtime","web-services"],"not_affected_if":["default-config"],"how_to_check":"- Check the Axis2/Java version in use: `2.0.1` is affected.\n- Look for the OpenAPI module (Swagger UI page) enabled on the Axis2 deployment.","fix":"- Apache Axis2/Java: upgrade to `2.0.2`","status":"open","published_at":"2026-11-09T11:17:24+00:00","first_seen_at":"2026-11-09T11:26:04+00:00","triaged_at":"2026-11-09T11:26:51+00:00","updated_at":"2026-11-09T11:26:51+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-09T11:26:51Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Axis2/Java: upgrade to `2.0.2`","reach":"internet","title":"Apache Axis2: Host header reflected into Swagger UI page enables script injection","impact":"medium","summary":"The OpenAPI module of Apache Axis2/Java writes a value taken from the request's Host header into the Swagger UI page without encoding it. An attacker can get script to run in the browser of a user visiting the Axis2 origin.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-axis2","java","web-services"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"script runs in a visitor's browser on the Axis2 origin","analyst_note":"","how_to_check":"- Check the Axis2/Java version in use: `2.0.1` is affected.\n- Look for the OpenAPI module (Swagger UI page) enabled on the Axis2 deployment.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Only deployments running Apache Axis2/Java 2.0.1 with the OpenAPI module serving its Swagger UI page are exposed. Installations on other versions or without that module are not described as affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4628,"output_tokens":490,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123766':15A,18A '-2026':14A,17A '2.0.1':127C '2.0.2':135C 'affect':124C 'allow':112C 'apach':1A,20B,31B,86C,125C 'apache-axis2':19B 'attack':52B 'axis2':2A,21B,66B,120C 'axis2/java':32B,87C,126C 'browser':60B 'context':117C 'cross':77C 'cross-sit':76C 'cve':13A,16A 'deriv':100C 'enabl':10A 'encod':49B,111C 'fix':137C 'generat':75C 'get':54B 'header':4A,42B,106C 'host':3A,41B,105C 'improp':68C 'inject':12A,114C 'input':71C 'issu':123C,139C 'java':22B 'modul':29B,84C,96C 'neutral':69C 'openapi':28B,83C,95C 'origin':67B,121C 'page':9A,47B,74C,91C,109C 'recommend':130C 'reflect':5A 'request':39B,103C 'run':57B 'runtim':23B 'script':11A,55B,79C,113C 'serv':92C 'servic':26B 'site':78C 'swagger':7A,45B,89C 'taken':36B 'ui':8A,46B,90C 'upgrad':132C 'user':63B,128C 'valu':35B,99C 'version':134C 'visit':64B 'vulner':80C 'web':25B,73C 'web-servic':24B 'without':48B,110C 'write':33B 'wrote':97C","nicknames":[],"mitigations":[],"who_affected":"Only deployments running Apache Axis2/Java 2.0.1 with the OpenAPI module serving its Swagger UI page are exposed. Installations on other versions or without that module are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheaxis2","java","medium","runtime","webservices"],"campaign_type":null,"search_a":"'-123766':15A,18A '-2026':14A,17A 'apach':1A 'axis2':2A 'cve':13A,16A 'enabl':10A 'header':4A 'host':3A 'inject':12A 'page':9A 'reflect':5A 'script':11A 'swagger':7A 'ui':8A","search_b":"'apach':20B,31B 'apache-axis2':19B 'attack':52B 'axis2':21B,66B 'axis2/java':32B 'browser':60B 'encod':49B 'get':54B 'header':42B 'host':41B 'java':22B 'modul':29B 'openapi':28B 'origin':67B 'page':47B 'request':39B 'run':57B 'runtim':23B 'script':55B 'servic':26B 'swagger':45B 'taken':36B 'ui':46B 'user':63B 'valu':35B 'visit':64B 'web':25B 'web-servic':24B 'without':48B 'write':33B","search_c":"'2.0.1':127C '2.0.2':135C 'affect':124C 'allow':112C 'apach':86C,125C 'axis2':120C 'axis2/java':87C,126C 'context':117C 'cross':77C 'cross-sit':76C 'deriv':100C 'encod':111C 'fix':137C 'generat':75C 'header':106C 'host':105C 'improp':68C 'inject':114C 'input':71C 'issu':123C,139C 'modul':84C,96C 'neutral':69C 'openapi':83C,95C 'origin':121C 'page':74C,91C,109C 'recommend':130C 'request':103C 'script':79C,113C 'serv':92C 'site':78C 'swagger':89C 'ui':90C 'upgrad':132C 'user':128C 'valu':99C 'version':134C 'vulner':80C 'web':73C 'without':110C 'wrote':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123766","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123766","severity":null,"published_at":"2026-11-09T11:17:24+00:00","modified_at":"2026-11-09T11:17:24+00:00","first_seen_at":"2026-11-09T11:26:04+00:00","fetched_at":"2026-11-09T11:26:04+00:00","note":null}],"documents":[{"id":107113,"url":"https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}