CVE-2026-120832: Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution

The Brief

Apache Axis2/Java before 2.0.2 has a Server-Side Request Forgery (SSRF) vulnerability.
The flaw occurs when Axis2 builds a service description from a WSDL, through WSDL/XSD schema import resolution.
The advisory is rated moderate and is tracked as CVE-2026-120832.

Why it matters

Applications that build Axis2 service descriptions from WSDL files can be tricked into making server-side requests to arbitrary locations, which can expose internal services.

Who’s affected

Apache Axis2/Java users running versions before 2.0.2

What to do

Upgrade Apache Axis2/Java to 2.0.2 or later.

Apache Axis2/Java 2.0.2
CVE-2026-120832
#security
#ssrf
#apache-axis2
#java
#cve
#web-services

Posted by Robert Lazarski on Nov 06 Severity: moderate Affected versions: - Apache Axis2/Java before 2.0.2 Description: Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient…

Read the full story at seclists.org ↗

Timeline

Nov 6
Vulnerability disclosed on the oss-sec mailing list
Nov 6 · 6:28 PM
Open Source Security
CVE-2026-120832: Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution