Cyber ·
CVE-2026-123753: SSRF in Apache Axis2/Java via WS-Addressing ReplyTo and FaultTo endpoints
Advisory published on November 6, 2026 about an SSRF flaw in Apache Axis2/Java before version 2.0.2, reachable without authentication through the WS-Addressing ReplyTo and FaultTo addresses.
The advisory CVE-2026-123753, published by Robert Lazarski on November 6, 2026 in the oss-sec feed and rated important, describes a Server-Side Request Forgery (SSRF) flaw in Apache Axis2/Java. Versions before 2.0.2 are affected. According to the text, an unauthenticated requester can supply a non-anonymous address in the wsa:ReplyTo or wsa:FaultTo headers. Axis2 then opens a connection to that address to deliver the response or fault. This makes it possible to send requests to internal hosts and to send response content to a destination host. The available text is an automatic translation and is truncated, so before drawing conclusions about a specific environment, consult the original advisory referenced in the oss-sec feed and the official Apache Axis2 documentation. To check exposure, identify applications that use Axis2/Java and confirm the version in use.