CVE-2026-120832: Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution

Q: Which Axis2/Java deployments are exposed?

Axis2/Java versions through 2.0.1 are affected when an application builds a service description from a WSDL using ServiceClient, AxisService.createClientSideAxisService, or WSDLToAxisServiceBuilder. AAR and WAR deployment resolver paths are also affected when they process absolute schema locations.

Q: What must an attacker control to exploit this issue?

The attacker must be able to supply or control a WSDL or XML schema that the Axis2 application processes. They can use absolute wsdl:import locations or xsd:import and xsd:include schemaLocation values to cause the JVM to request arbitrary internal or external hosts.

Q: Are imports restricted to safe protocols or hosts by default?

No. The affected behavior resolves absolute import and schema URLs without scheme or host restrictions, allowing network requests to arbitrary destinations.

Q: What is the recommended remediation?

Upgrade Apache Axis2/Java to version 2.0.2, which fixes the issue.

Published Nov 6, 2026

Updated

Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import locations and in xsd:import and xsd:include schemaLocations with no scheme or host restriction; the AAR and WAR deployment resolvers also passed absolute schema locations on to the network. An attacker who controls a WSDL or schema processed by an Axis2 application could therefore make the JVM send requests to arbitrary internal or external hosts. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Affected Software

1 affected component

Apache Axis2/Java<=2.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Axis2/Java to a version that resolves this vulnerability.
Fixed in 2.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·10:22 AM

Data Sourced

via MITRE·10:22 AM

DescriptionWeakness

Frequently Asked Questions

Which Axis2/Java deployments are exposed?

Axis2/Java versions through 2.0.1 are affected when an application builds a service description from a WSDL using ServiceClient, AxisService.createClientSideAxisService, or WSDLToAxisServiceBuilder. AAR and WAR deployment resolver paths are also affected when they process absolute schema locations.

What must an attacker control to exploit this issue?

The attacker must be able to supply or control a WSDL or XML schema that the Axis2 application processes. They can use absolute wsdl:import locations or xsd:import and xsd:include schemaLocation values to cause the JVM to request arbitrary internal or external hosts.

Are imports restricted to safe protocols or hosts by default?

No. The affected behavior resolves absolute import and schema URLs without scheme or host restrictions, allowing network requests to arbitrary destinations.

What is the recommended remediation?

Upgrade Apache Axis2/Java to version 2.0.2, which fixes the issue.

CVE-2026-120832: Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Axis2/Java deployments are exposed?

What must an attacker control to exploit this issue?

Are imports restricted to safe protocols or hosts by default?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which Axis2/Java deployments are exposed?

What must an attacker control to exploit this issue?

Are imports restricted to safe protocols or hosts by default?

What is the recommended remediation?