Apache Axis2/Java: SSRF via WS-Addressing endpoints (CVE-2026-123753)
Apache Axis2/Java versions prior to 2.0.2 are vulnerable to unauthenticated SSRF, allowing attackers to force the server to initiate requests to arbitrary network destinations.
CVE search metadata
CVE search record: CVE-2026-123753. KEV: no. Product: Axis2/Java (< 2.0.2). Brief: Apache Axis2/Java: SSRF via WS-Addressing endpoints (CVE-2026-123753). Brief link: https://feed.craftedsignal.io/briefs/2026-11-axis2-ssrf/
Triage facts
Revision 1- Applicability
- Axis2/Java (< 2.0.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 6, 19:23 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- D3Roughly even chance
Apache Axis2/Java versions prior to 2.0.2 are vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can supply a non-anonymous WS-Addressing 'wsa:ReplyTo' or 'wsa:FaultTo' header, causing the service to initiate a connection to the specified address. This can lead to unauthorized access to internal resources or sensitive network infrastructure.
Impact
Successful exploitation allows attackers to perform requests to internal hosts accessible by the Axis2 server, potentially bypassing network segmentation or accessing internal services that do not require authentication.
Recommendation
- Upgrade Apache Axis2/Java to version 2.0.2 or later immediately.
- Audit web server and application logs for unusual 'wsa:ReplyTo' or 'wsa:FaultTo' address patterns in SOAP headers.
- Restrict egress traffic from the application server to prevent unauthorized internal network access.
Immediate actions
Upgrade Apache Axis2/Java to version 2.0.2 or later
Threat Hunt
Inspect web application logs for SOAP messages containing non-anonymous wsa:ReplyTo or wsa:FaultTo endpoints targeting internal IP ranges.
Data: Web server access logs, Application-level SOAP request logs
Mitigations
Upgrade to Axis2/Java 2.0.2
CVE-2026-123753