Cyber ·
CVE-2026-120832: SSRF in Apache Axis2/Java when resolving WSDL and XSD imports
Apache Axis2/Java versions before 2.0.2 fetched absolute URLs from WSDL and XSD imports without scheme or host restrictions. The advisory, published on the oss-sec feed on November 6, 2026, rates the severity as moderate.
Advisory CVE-2026-120832 describes a server-side request forgery (SSRF) flaw in Apache Axis2/Java. Versions before 2.0.2 fetched absolute URLs in the wsdl:import, xsd:import and xsd:include schemaLocation attributes without scheme or host restrictions. The flaw appears when Axis2 builds a service description from a WSDL through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder. The text rates the severity as moderate and was published on the oss-sec feed on November 6, 2026. This is an automatic translation, and the received content is truncated, so further details are not included here.
Rota Nacional does not patch third-party libraries and does not act as an egress traffic filter. The fix is to upgrade Axis2 to version 2.0.2 or later. Teams that connect Java applications to the platform through the API should remember that controlling where their application sends HTTP requests is the responsibility of the project itself. To verify the situation, read the original advisory in the November 2026 oss-sec archive and check the Axis2 version in your build and transitive dependencies.