APACHE AXIS2/JAVA · CVE-2026-123779 · Runtime
NO FIX YET · SEE WHAT TO DO
Apache Axis2/Java ignored the exposeServiceMetadata setting on several routes, so services that disabled it still revealed their WSDL, XSD, OpenAPI and operation schemas. An anonymous caller can read operation names and request and response shapes, but not invoke or change anything.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only services built on Apache Axis2/Java through 2.0.1 that set exposeServiceMetadata to false are affected, since the setting was enforced only on some routes. Teams running Axis2 with metadata exposed, or on another stack, can skip it.
Not affected if metadata-exposed, other-stack
Who cares apache-axis2, java, web-services
axis2.war or the axis2 library in the build, for example unknown if it cannot be read.exposeServiceMetadata to false in services.xml; those are the ones that leaked..wsdl, .xsd, ?wsdl or routes anonymously and see whether they respond.Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone HTTP server, the OpenAPI, Swagger UI and MCP catalog endpoints, the services listing, WS-MetadataExchange GetMetadata and the ping module still disclosed its metadata to anonymous callers, including operation names and request and response schemas. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
/services2.0.2.