Apache Axis2/Java: Inconsistent enforcement of exposeServiceMetadata (CVE-2026-123779)
Apache Axis2/Java contains a forced browsing vulnerability where the exposeServiceMetadata parameter is not enforced on specific routes, allowing unauthorized metadata disclosure.
CVE search metadata
CVE search record: CVE-2026-123779. KEV: no. Product: Axis2/Java (< 2.0.2). Brief: Apache Axis2/Java: Inconsistent enforcement of exposeServiceMetadata (CVE-2026-123779). Brief link: https://feed.craftedsignal.io/briefs/2026-11-axis2-forced-browsing/
Triage facts
Revision 1- Applicability
- Axis2/Java (< 2.0.2)
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 6, 19:22 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Apache Axis2/Java is vulnerable to forced browsing due to inconsistent enforcement of the exposeServiceMetadata configuration parameter. While the parameter is intended to disable metadata exposure, it fails to restrict access to packaged .wsdl and .xsd files, as well as the named-WSDL ?wsdl=NAME route in the standalone HTTP server. This vulnerability allows an attacker to retrieve service metadata even when explicitly disabled.
Impact
The vulnerability may lead to unauthorized information disclosure of internal service configurations and API definitions, potentially aiding further reconnaissance of the target infrastructure.
Recommendation
- Upgrade Apache Axis2/Java to version 2.0.2 or later to ensure the exposeServiceMetadata configuration is correctly enforced across all metadata endpoints.
- Review public-facing Axis2/Java instances to identify and restrict access to sensitive WSDL and XSD metadata routes until patches are applied.
Immediate actions
Patch Apache Axis2/Java to 2.0.2
Threat Hunt
Identify unauthorized access to WSDL or XSD files on Axis2 endpoints
Data: Web server access logs
Mitigations
Upgrade Apache Axis2/Java to version 2.0.2 or later
CVE-2026-123779