CVE-2026-123753: Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints

Q: Which deployments are exposed to this issue?

Apache Axis2/Java versions through 2.0.1 are affected. An exposed service can be targeted by an unauthenticated caller that can submit WS-Addressing headers.

Q: What does an attacker need to exploit the vulnerability?

The attacker needs to supply a non-anonymous wsa:ReplyTo or wsa:FaultTo address in a request. Axis2 may then connect to that address to send a response or fault, enabling requests to internal hosts and response delivery to an attacker-controlled host.

Q: Are decoupled response endpoints enabled by default after upgrading?

In version 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is explicitly enabled. When enabled, endpoints are restricted by scheme and screened during both header parsing and transport selection.

Q: What should be done if the service uses non-anonymous response endpoints?

Upgrade to Axis2/Java 2.0.2. If non-anonymous response endpoints are required, enable them only after reviewing the scheme restrictions and endpoint screening introduced in that version.

Published Nov 6, 2026

Updated

Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Affected Software

1 affected component

Apache Axis2/Java<=2.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Axis2/Java to a version that resolves this vulnerability.
Fixed in 2.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·10:28 AM

Data Sourced

via MITRE·10:28 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache Axis2/Java versions through 2.0.1 are affected. An exposed service can be targeted by an unauthenticated caller that can submit WS-Addressing headers.

What does an attacker need to exploit the vulnerability?

The attacker needs to supply a non-anonymous wsa:ReplyTo or wsa:FaultTo address in a request. Axis2 may then connect to that address to send a response or fault, enabling requests to internal hosts and response delivery to an attacker-controlled host.

Are decoupled response endpoints enabled by default after upgrading?

In version 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is explicitly enabled. When enabled, endpoints are restricted by scheme and screened during both header parsing and transport selection.

What should be done if the service uses non-anonymous response endpoints?

Upgrade to Axis2/Java 2.0.2. If non-anonymous response endpoints are required, enable them only after reviewing the scheme restrictions and endpoint screening introduced in that version.

CVE-2026-123753: Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Are decoupled response endpoints enabled by default after upgrading?

What should be done if the service uses non-anonymous response endpoints?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Are decoupled response endpoints enabled by default after upgrading?

What should be done if the service uses non-anonymous response endpoints?