Apache Axis2/Java: Cross-site scripting in OpenAPI module (CVE-2026-123766)
Apache Axis2/Java version 2.0.1 contains a cross-site scripting (XSS) vulnerability in its OpenAPI module caused by improper sanitization of the Host header.
CVE search metadata
CVE search record: CVE-2026-123766. KEV: no. Product: Axis2/Java (< 2.0.2). Brief: Apache Axis2/Java: Cross-site scripting in OpenAPI module (CVE-2026-123766). Brief link: https://feed.craftedsignal.io/briefs/2026-11-apache-axis2-xss/
Triage facts
Revision 1- Applicability
- Axis2/Java (< 2.0.2)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 6, 19:23 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
Apache Axis2/Java versions prior to 2.0.2 are vulnerable to cross-site scripting (XSS) within the OpenAPI module. The vulnerability occurs because the Swagger UI page improperly handles the Host header, injecting it into the web page content without sanitization. This allows remote attackers to execute arbitrary scripts in the context of the Axis2 origin.
Impact
Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the Axis2 origin, potentially leading to session hijacking or unauthorized actions performed by users viewing the affected Swagger UI page.
Recommendation
- Update Apache Axis2/Java to version 2.0.2 or later to remediate the underlying XSS vulnerability in the OpenAPI module.
- As a temporary mitigation, utilize a web application firewall (WAF) to inspect and sanitize the Host header value in incoming requests before they reach the backend application.
Immediate actions
Patch Apache Axis2/Java to 2.0.2 or higher
Threat Hunt
Hunt for HTTP requests with unusual, non-standard, or script-heavy strings in the Host header targeting the Swagger UI endpoint
Data: Web server access logs, WAF logs (Host header field)
Mitigations
Configure WAF/Reverse Proxy to sanitize or restrict the Host header
CVE-2026-123766