CVE-2026-123753 Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123753?
CVE-2026-123753 is a critical vulnerability in Apache Axis2/Java, published on 9 Nov 2026.
Official description
Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Weakness: CWE-918
Which versions are affected by CVE-2026-123753?
How do I fix CVE-2026-123753?
No fix has been published for CVE-2026-123753 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123753 being exploited?
There is no known exploitation of CVE-2026-123753 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-p73m-5r4v-xhg8.