CVE-2026-123753

Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

• CWE-918

• https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html
• https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117
• https://github.com/apache/axis-axis2-java-core/commit/1b6856b4d7903780786c79327bed1b53ea051a15
• https://lists.apache.org/thread.html/rddzl5jfmlr09yr9qj33by7kzprwwvnc
• https://www.openwall.com/lists/oss-security/2026/11/06/23

Published

Nov 9, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12374Improper certificate validation and a time-of-check time-of-…6.4
• CVE-2026-123746The Symfony Security HTTP component AuthenticatorManager::au…2.3
• CVE-2026-123747A flaw was found in pappl-retrofit. The application fails to…7.3
• CVE-2026-123748A security flaw has been discovered in chenyme grok2api up t…4.3
• CVE-2026-12375The uncanny-automator-pro WordPress plugin before 7.3.0.6 wa…9.8
• CVE-2026-123751The WP Duplicate WordPress plugin through 1.1.11 does not p…9.8
• CVE-2026-12376The Academy LMS WordPress plugin through 3.8.2 does not rest…4.3
• CVE-2026-123765Improper neutralization of input during web page generation …
• CVE-2026-123766Improper Neutralization of Input During Web Page Generation …
• CVE-2026-123770Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2026-123776RRD::CGI::Image versions through 0.01 for Perl pass CGI quer…9.8
• CVE-2026-123779Direct Request ('Forced Browsing') vulnerability in Apache A…5.3