Apache Axis2/Java exposeServiceMetadata not enforced on all metadata routes
Original title: CVE-2026-123779: Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes
The exposeServiceMetadata service parameter is enforced only on ?wsdl, ?wsdl2 and ?xsd queries, allowing forced browsing of .wsdl and .xsd routes in Apache Axis2/Java before 2.0.2.
Apache Axis2/Java before 2.0.2 implements the exposeServiceMetadata service parameter to control metadata exposure. Enforcement occurs only for ?wsdl, ?wsdl2 and ?xsd queries. For services that disable metadata, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone HTTP server, and other metadata routes remain accessible via direct requests.
- Enforcement limited to specific queries
- Affected Apache Axis2/Java before 2.0.2
- Direct Request vulnerability
Impact: forced browsing of metadata routes
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123779 | Metadata disclosure in Apache Axis2/Java before 2.0.2 | — | — |
From the original article
Posted by Robert Lazarski on Nov 06 Severity: low Affected versions: - Apache Axis2/Java before 2. 0. 2 - Apache Axis2/Java before 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.