CVE-2026-123766: Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page
Published Nov 6, 2026
·Updated
Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injection in the context of the Axis2 origin. This issue affects Apache Axis2/Java: 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Affected Software
1 affected component
Apache Axis2/Java=2.0.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Axis2/Javato a version that resolves this vulnerability.Fixed in 2.0.2
Event History
Nov 9, 2026
CVE Published
via MITRE·10:27 AM
Data Sourced
via MITRE·10:27 AM
DescriptionWeakness