Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Apache Axis2/Java SSRF via WSDL/XSD schema import resolution

Original title: CVE-2026-120832: Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution

oss-security ()1
Read at seclists.org
Part of a story covered by 7 sourcesApache Axis2/Java 2.0.2 fixes seven flaws including XXE and SSRFMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Apache Axis2/Java before 2.0.2 allows SSRF when building service descriptions from WSDL through unrestricted fetching of absolute URLs in wsdl:import and xsd:import/include locations.

Apache Axis2/Java before 2.0.2 fetches absolute URLs from wsdl:import locations and xsd:import and xsd:include schemaLocations during service description construction. ServiceClient, AxisService.createClientSideAxisService and WSDLToAxisServiceBuilder perform these fetches without scheme or host restrictions. This enables SSRF attacks.

Key facts
  • Unrestricted fetching of schema URLs
  • Affects Apache Axis2/Java before 2.0.2
  • SSRF via WSDL/XSD imports
Security assessment · AI, from the article

Impact: server-side request forgery

Analyze CVE-2026-120832 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-120832
Tags
apacheaxis2ssrfwsdl
Vendors
Apache
Products
Axis2/Java

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-120832
SSRF in Apache Axis2/Java via WSDL/XSD imports
——

From the original article

Posted by Robert Lazarski on Nov 06 Severity: moderate Affected versions: - Apache Axis2/Java before 2. 0. 2 Description: Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.