{"affected":[{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"org.apache.axis2:axis2-kernel","product":"Apache Axis2/Java","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-120832","cwes":["CWE-918"],"description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import locations and in xsd:import and xsd:include schemaLocations with no scheme or host restriction; the AAR and WAR deployment resolvers also passed absolute schema locations on to the network. An attacker who controls a WSDL or schema processed by an Axis2 application could therefore make the JVM send requests to arbitrary internal or external hosts. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794223041990,"publishedAt":1794219722605,"references":[{"source":"CNA: apache","tags":["release-notes"],"url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"CNA: apache","tags":["patch"],"url":"https://github.com/apache/axis-axis2-java-core/commit/7ac84d8339ad80f8f7f7977cf0caaa28fc3b7b98"},{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/bdf689rhvgg6rtlgqvvq8728f8pkj6zb"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/11/06/27"},{"source":"security@apache.org","tags":[],"url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"security@apache.org","tags":[],"url":"https://github.com/apache/axis-axis2-java-core/commit/7ac84d8339ad80f8f7f7977cf0caaa28fc3b7b98"},{"source":"security@apache.org","tags":[],"url":"https://lists.apache.org/thread.html/bdf689rhvgg6rtlgqvvq8728f8pkj6zb"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/11/06/27"}],"remediation":[{"kind":"fix","source":"CNA: apache","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/apache/axis-axis2-java-core/commit/7ac84d8339ad80f8f7f7977cf0caaa28fc3b7b98"}],"revision":"9f1aaeeb98e548027d295d56cfe949cb5d35b7169ee23621107b5471f1158108","sources":[{"modifiedAt":1794222503882,"name":"CNA: apache","retrievedAt":1794226153708,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120832"},{"modifiedAt":1794223041990,"name":"NVD","retrievedAt":1794226704914,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120832"}],"ssvc":null,"status":"published","title":"Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution","updatedAt":1794226704914}