org.apache.axis2/axis2-openapi vulnerabilities

Latest org.apache.axis2/axis2-openapi CVEs

Newest publication first

1. CVE-2026-123779 Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes

   Published 2026-11-09

   Unknown

   Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route...

2. CVE-2026-123766 Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page

   Published 2026-11-09

   Unknown

   Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allow...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.