{"id":"CVE-2026-123779","kind":"vulnerability","aliases":["CVE-2026-123779"],"related":[],"title":"Apache Axis2: disabled service metadata still disclosed to anonymous callers","description":"Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone HTTP server, the OpenAPI, Swagger UI and MCP catalog endpoints, the services listing, WS-MetadataExchange GetMetadata and the ping module still disclosed its metadata to anonymous callers, including operation names and request and response schemas. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.","summary":"Apache Axis2/Java ignored the exposeServiceMetadata setting on several routes, so services that disabled it still revealed their WSDL, XSD, OpenAPI and operation schemas. An anonymous caller can read operation names and request and response shapes, but not invoke or change anything.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apache Axis2/Java","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-axis2","java","runtime","web-services"],"not_affected_if":["metadata-exposed","other-stack"],"how_to_check":"- Check the Axis2 version in the deployed `axis2.war` or the `axis2` library in the build, for example `unknown` if it cannot be read.\n- Look for services that set `exposeServiceMetadata` to `false` in `services.xml`; those are the ones that leaked.\n- Request the `.wsdl`, `.xsd`, `?wsdl` or `/services` routes anonymously and see whether they respond.","fix":"- Apache Axis2/Java: upgrade to `2.0.2`.","status":"open","published_at":"2026-11-09T11:17:24+00:00","first_seen_at":"2026-11-09T11:26:04+00:00","triaged_at":"2026-11-09T11:26:50+00:00","updated_at":"2026-11-09T11:26:50+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-09T11:26:50Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Axis2/Java: upgrade to `2.0.2`.","reach":"internet","title":"Apache Axis2: disabled service metadata still disclosed to anonymous callers","impact":"low","summary":"Apache Axis2/Java ignored the exposeServiceMetadata setting on several routes, so services that disabled it still revealed their WSDL, XSD, OpenAPI and operation schemas. An anonymous caller can read operation names and request and response shapes, but not invoke or change anything.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-axis2","java","web-services"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Anonymous callers read operation names and request and response schemas","analyst_note":"","how_to_check":"- Check the Axis2 version in the deployed `axis2.war` or the `axis2` library in the build, for example `unknown` if it cannot be read.\n- Look for services that set `exposeServiceMetadata` to `false` in `services.xml`; those are the ones that leaked.\n- Request the `.wsdl`, `.xsd`, `?wsdl` or `/services` routes anonymously and see whether they respond.","plain_action":"","product_name":"Apache Axis2/Java","needs_analyst":false,"not_affected_if":["metadata-exposed","other-stack"],"who_is_affected":"Only services built on Apache Axis2/Java through 2.0.1 that set exposeServiceMetadata to false are affected, since the setting was enforced only on some routes. Teams running Axis2 with metadata exposed, or on another stack, can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000784,"input_tokens":4730,"output_tokens":622,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123779':13A,16A '-2026':12A,15A '2.0.1':156C '2.0.2':164C 'affect':152C 'anonym':9A,51B,140C 'anyth':67B 'apach':1A,20B,27B,74C,153C 'apache':17A 'apache-axis2':19B 'axis2':2A,21B 'axis2/java':18A,28B,75C,154C 'brows':71C 'caller':10A,52B,141C 'catalog':122C 'chang':66B 'cve':11A,14A 'direct':68C 'disabl':3A,39B,95C 'disclos':7A,136C 'endpoint':123C 'enforc':81C 'exposeservicemetadata':31B,77C 'file':102C 'fix':166C 'forc':70C 'getmetadata':130C 'http':114C 'ignor':29B 'includ':142C 'invok':64B 'issu':151C,168C 'java':22B 'list':126C 'mcp':121C 'metadata':5A,138C 'metadataexchang':129C 'modul':134C 'name':56B,106C,109C,144C 'named-wsdl':105C 'openapi':46B,117C 'oper':48B,55B,143C 'packag':98C 'paramet':79C 'ping':133C 'queri':89C 'read':54B 'recommend':159C 'request':58B,69C,146C 'respons':60B,148C 'reveal':42B 'rout':35B,103C,110C 'runtim':23B 'schema':49B,149C 'server':115C 'servic':4A,26B,37B,78C,92C,125C 'set':32B 'sever':34B 'shape':61B 'standalon':113C 'still':6A,41B,135C 'swagger':118C 'ui':119C 'upgrad':161C 'user':157C 'version':163C 'vulner':72C 'web':25B 'web-servic':24B 'ws':128C 'ws-metadataexchang':127C 'wsdl':44B,85C,99C,107C,108C 'wsdl2':86C 'xsd':45B,88C,101C","nicknames":[],"mitigations":[],"who_affected":"Only services built on Apache Axis2/Java through 2.0.1 that set exposeServiceMetadata to false are affected, since the setting was enforced only on some routes. Teams running Axis2 with metadata exposed, or on another stack, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apacheaxis2java","axis2java"],"ptokens":["apache","axis2","java"],"labels":["apacheaxis2","java","low","runtime","vendor","webservices"],"campaign_type":null,"search_a":"'-123779':13A,16A '-2026':12A,15A 'anonym':9A 'apach':1A 'apache':17A 'axis2':2A 'axis2/java':18A 'caller':10A 'cve':11A,14A 'disabl':3A 'disclos':7A 'metadata':5A 'servic':4A 'still':6A","search_b":"'anonym':51B 'anyth':67B 'apach':20B,27B 'apache-axis2':19B 'axis2':21B 'axis2/java':28B 'caller':52B 'chang':66B 'disabl':39B 'exposeservicemetadata':31B 'ignor':29B 'invok':64B 'java':22B 'name':56B 'openapi':46B 'oper':48B,55B 'read':54B 'request':58B 'respons':60B 'reveal':42B 'rout':35B 'runtim':23B 'schema':49B 'servic':26B,37B 'set':32B 'sever':34B 'shape':61B 'still':41B 'web':25B 'web-servic':24B 'wsdl':44B 'xsd':45B","search_c":"'2.0.1':156C '2.0.2':164C 'affect':152C 'anonym':140C 'apach':74C,153C 'axis2/java':75C,154C 'brows':71C 'caller':141C 'catalog':122C 'direct':68C 'disabl':95C 'disclos':136C 'endpoint':123C 'enforc':81C 'exposeservicemetadata':77C 'file':102C 'fix':166C 'forc':70C 'getmetadata':130C 'http':114C 'includ':142C 'issu':151C,168C 'list':126C 'mcp':121C 'metadata':138C 'metadataexchang':129C 'modul':134C 'name':106C,109C,144C 'named-wsdl':105C 'openapi':117C 'oper':143C 'packag':98C 'paramet':79C 'ping':133C 'queri':89C 'recommend':159C 'request':69C,146C 'respons':148C 'rout':103C,110C 'schema':149C 'server':115C 'servic':78C,92C,125C 'standalon':113C 'still':135C 'swagger':118C 'ui':119C 'upgrad':161C 'user':157C 'version':163C 'vulner':72C 'ws':128C 'ws-metadataexchang':127C 'wsdl':85C,99C,107C,108C 'wsdl2':86C 'xsd':88C,101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123779","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123779","severity":null,"published_at":"2026-11-09T11:17:24+00:00","modified_at":"2026-11-09T11:17:24+00:00","first_seen_at":"2026-11-09T11:26:04+00:00","fetched_at":"2026-11-09T11:26:04+00:00","note":null}],"documents":[{"id":107113,"url":"https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":107120,"url":"https://github.com/apache/axis-axis2-java-core/commit/8a81216b1b723e98a3c801de939201ad68f59b23","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}