Cyber ·
CVE-2026-123779: Apache Axis2/Java does not apply exposeServiceMetadata to all metadata routes
Low-severity advisory on Apache Axis2/Java before 2.0.2: the exposeServiceMetadata setting does not cover some WSDL and XSD routes, allowing direct access to metadata of services where it was disabled.
On 6 November, Robert Lazarski published on the oss-sec mailing list feed an advisory about Apache Axis2/Java. According to the text, in versions before 2.0.2 the exposeServiceMetadata setting was applied only to the ?wsdl, ?wsdl2 and ?xsd queries. For a service where it was disabled, the packaged .wsdl and .xsd files remained accessible, along with the ?wsdl=NAME route for named WSDL on the standalone HTTP server, and other routes the available excerpt does not detail. The advisory rates severity as low and describes the flaw as forced browsing. The corrected version cited is 2.0.2.
The relevance for organizations is the exposure of service descriptions that should be hidden. That information can help reconnaissance of an attack surface, but the advisory does not describe code execution or leakage of business data. Anyone running Axis2 should check the installed version and, if it is older than 2.0.2, plan an upgrade. Because the source is an automatic translation, the technical reading should be checked against the original text and the Apache project notices.
Rota Nacional does not patch third-party libraries or replace upgrading internal servers. No platform capability addresses this flaw. To study the advisory with AI, do not paste internal service names, addresses or credentials into the tool; use only the public text.