---
id: "CVE-2026-123779"
page: "https://infrastack.ai/live/CVE-2026-123779"
kind: "vulnerability"
aliases: ["CVE-2026-123779"]
title: "Apache Axis2: disabled service metadata still disclosed to anonymous callers"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Apache Axis2/Java", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apache-axis2", "java", "runtime", "web-services"]
not_affected_if: ["metadata-exposed", "other-stack"]
published_at: "2026-11-09T11:17:24+00:00"
first_seen_at: "2026-11-09T11:26:04+00:00"
updated_at: "2026-11-09T11:26:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123779", "first_seen_at": "2026-11-09T11:26:04+00:00"}]
exploit_sources: []
---

# Apache Axis2: disabled service metadata still disclosed to anonymous callers

Link for people: https://infrastack.ai/live/CVE-2026-123779 (this .md is for agents)

Apache Axis2/Java ignored the exposeServiceMetadata setting on several routes, so services that disabled it still revealed their WSDL, XSD, OpenAPI and operation schemas. An anonymous caller can read operation names and request and response shapes, but not invoke or change anything.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Axis2/Java affected range not listed fixed no fixed version listed

## How to check

- Check the Axis2 version in the deployed `axis2.war` or the `axis2` library in the build, for example `unknown` if it cannot be read.
- Look for services that set `exposeServiceMetadata` to `false` in `services.xml`; those are the ones that leaked.
- Request the `.wsdl`, `.xsd`, `?wsdl` or `/services` routes anonymously and see whether they respond.

## Fix

- Apache Axis2/Java: upgrade to `2.0.2`.

## Timeline

- 2026-11-09T11:26:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123779

## Documents

- [fix] Patch: github.com https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117
- [fix] Patch: github.com https://github.com/apache/axis-axis2-java-core/commit/8a81216b1b723e98a3c801de939201ad68f59b23

## From the sources

Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone HTTP server, the OpenAPI, Swagger UI and MCP catalog endpoints, the services listing, WS-MetadataExchange GetMetadata and the ping module still disclosed its metadata to anonymous callers, including operation names and request and response schemas. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_