Direct Request Vulnerability in Apache Axis2/Java

CVE-2026-123779

What is CVE-2026-123779?

A Direct Request vulnerability in Apache Axis2/Java allows unauthorized access to sensitive service metadata. The 'exposeServiceMetadata' parameter was only enforced for specific queries, leading to exposure of operational metadata such as request and response schemas, operation names, and other details via various routes even when disabled. This issue can present security risks by disclosing sensitive information to malicious users. Users are urged to upgrade to version 2.0.2 to mitigate this vulnerability.

References