Cyber ·
CVE-2026-123766: XSS in the Apache Axis2/Java OpenAPI module, fixed in version 2.0.2
Moderate-severity advisory on cross-site scripting in the Swagger UI page of the Apache Axis2/Java OpenAPI module. The Host request header value was written into the page without encoding. Version 2.0.1 is affected, and the fix is in 2.0.2.
On 6 November 2026, the oss-sec list published identifier CVE-2026-123766, describing improper neutralization of input during web page generation (Cross-site Scripting) in the OpenAPI module of Apache Axis2/Java. The stated severity is moderate. Affected versions are Apache Axis2/Java 2.0.1, before 2.0.2. According to the advisory, the Swagger UI page served by the OpenAPI module wrote to the page, without encoding, a value derived from the Host header of the request. This allowed script injection in the origin context of Axis2. The source text available is an automatically translated summary and is cut off at the end, so full details should be checked in the original, referenced on the oss-sec list and the Apache project site. To verify exposure, identify whether the application uses Axis2/Java 2.0.1 with the OpenAPI module enabled and whether the Swagger UI page is reachable. After upgrading to 2.0.2 or later, confirm the version in use and repeat the page access test.
Original source: CVE-2026-123766: Apache Axis2/Java: XSS na página Swagger UI do módulo OpenAPI