CVE-2026-123779: Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes

Q: Which deployments are exposed to this issue?

Apache Axis2/Java deployments through version 2.0.1 are affected when a service has disabled the exposeServiceMetadata parameter. Despite that setting, multiple metadata routes can remain accessible to anonymous callers.

Q: What does an attacker need to exploit the issue?

An attacker only needs anonymous HTTP access to an affected service's metadata endpoints. No authentication or prior access is described.

Q: What information can be disclosed?

The exposed metadata can reveal operation names and request and response schemas. Affected routes include packaged WSDL and XSD files, named-WSDL requests on the standalone HTTP server, OpenAPI, Swagger UI, MCP catalog, service listings, WS-MetadataExchange GetMetadata, and the ping module.

Q: What should teams do if they use an affected version?

Upgrade Apache Axis2/Java to version 2.0.2, which fixes the issue. Until upgrading, treat the listed metadata endpoints as potentially publicly accessible even where exposeServiceMetadata is disabled.

Published Nov 6, 2026

Updated

Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone HTTP server, the OpenAPI, Swagger UI and MCP catalog endpoints, the services listing, WS-MetadataExchange GetMetadata and the ping module still disclosed its metadata to anonymous callers, including operation names and request and response schemas. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Affected Software

1 affected component

Apache Axis2/Java<=2.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Axis2/Java to a version that resolves this vulnerability.
Fixed in 2.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·10:29 AM

Data Sourced

via MITRE·10:29 AM

DescriptionWeakness

Data Sourced

via NVD·11:17 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache Axis2/Java deployments through version 2.0.1 are affected when a service has disabled the exposeServiceMetadata parameter. Despite that setting, multiple metadata routes can remain accessible to anonymous callers.

What does an attacker need to exploit the issue?

An attacker only needs anonymous HTTP access to an affected service's metadata endpoints. No authentication or prior access is described.

What information can be disclosed?

The exposed metadata can reveal operation names and request and response schemas. Affected routes include packaged WSDL and XSD files, named-WSDL requests on the standalone HTTP server, OpenAPI, Swagger UI, MCP catalog, service listings, WS-MetadataExchange GetMetadata, and the ping module.

What should teams do if they use an affected version?

Upgrade Apache Axis2/Java to version 2.0.2, which fixes the issue. Until upgrading, treat the listed metadata endpoints as potentially publicly accessible even where exposeServiceMetadata is disabled.

CVE-2026-123779: Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the issue?

What information can be disclosed?

What should teams do if they use an affected version?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the issue?

What information can be disclosed?

What should teams do if they use an affected version?