Server-Side Request Forgery Vulnerability in Apache Axis2/Java

CVE-2026-123753

What is CVE-2026-123753?

A Server-Side Request Forgery (SSRF) vulnerability exists in Apache Axis2/Java, allowing an unauthenticated caller to exploit non-anonymous WS-Addressing addresses. This may lead to unauthorized access of internal services, as Axis2 attempts to deliver responses or faults to the specified address. The vulnerability affects versions up to 2.0.1, whereas version 2.0.2 introduces mitigations that refuse decoupled responses unless allowNonAnonymousResponseEndpoints is enabled, while enforcing strict endpoint validation. Users are strongly advised to upgrade to version 2.0.2 or later to ensure increased security.

References