CVE-2026-123779

Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone HTTP server, the OpenAPI, Swagger UI and MCP catalog endpoints, the services listing, WS-MetadataExchange GetMetadata and the ping module still disclosed its metadata to anonymous callers, including operation names and request and response schemas. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

• CWE-425

• https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html
• https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117
• https://github.com/apache/axis-axis2-java-core/commit/8a81216b1b723e98a3c801de939201ad68f59b23
• https://lists.apache.org/thread.html/qqn6c4fb8tj0ldmb97c75zzxdjrh5dl3
• https://www.openwall.com/lists/oss-security/2026/11/06/28

Published

Nov 9, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123753Server-Side Request Forgery (SSRF) vulnerability in Apache A…9.1
• CVE-2026-12376The Academy LMS WordPress plugin through 3.8.2 does not rest…4.3
• CVE-2026-123765Improper neutralization of input during web page generation …
• CVE-2026-123766Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2026-123770Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2026-123776RRD::CGI::Image versions through 0.01 for Perl pass CGI quer…9.8
• CVE-2026-12378The Appointment Booking Calendar Plugin and Scheduling Plugi…8.1
• CVE-2026-123782ChatWiki before 2.10.0 contains an insecure direct object re…4.3
• CVE-2026-123783Skyvern through 1.0.56 contains a sandbox bypass vulnerabili…8.8
• CVE-2026-123784Fluxbox through 1.3.7 contains an OS command injection vulne…7.8
• CVE-2026-123785Fluxbox through 1.3.7 contains an infinite loop vulnerabilit…5.5
• CVE-2026-123786Agenta before 0.122.5 contains a server-side request forgery…8.5