Apache Axis2/Java before 2.0.2 has SSRF via WS-Addressing endpoints (CVE-2026-123753)
An unauthenticated caller could supply a non-anonymous WS-Addressing address
50
CVE-2026-123753
Unauthenticated SSRF in Apache Axis2/Java before 2.0.2
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Axis2/Java SSRF lets unauthenticated callers supply non-anonymous WS-Addressing ReplyTo or FaultTo addresses. Axis2 connects to those endpoints for responses or faults, enabling internal host access and response delivery to attacker-chosen hosts. It affects versions through 2.0.1; upgrade to 2.0.2 fixes it.
What to do: Upgrade Apache Axis2/Java to 2.0.2
| Product | Affected | Fixed in |
|---|---|---|
| Apache Axis2/Java | through 2.0.1 | 2.0.2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
- Weakness
- CWE-918