Cross-site Scripting Vulnerability in Apache Axis2 OpenAPI Module

CVE-2026-123766

What is CVE-2026-123766?

This vulnerability arises from improper handling of input when generating web pages in the OpenAPI module of Apache Axis2/Java. Specifically, the Swagger UI page incorporates a value from the request's Host header directly into the page without appropriate encoding. This oversight enables attackers to inject scripts, which can execute in the context of the Axis2 origin, leading to potential exploitation. Users are strongly advised to upgrade to version 2.0.2 to mitigate the risk associated with this vulnerability.

References