# CVE-2026-120832: Apache Axis2 server-side request forgery in WSDL processing

Source: https://junglewise.ai/threats/cve-2026-120832-server-side-request-forgery-ssrf-vulnerability-in-apache-axis2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-120832 · Severity: info · Published 2026-11-09

Apache Axis2 is a web services framework that builds service descriptions from WSDL files. A server-side request forgery vulnerability allows an attacker who controls a WSDL or schema file to make an Axis2 application send HTTP requests to arbitrary internal or external hosts, potentially exposing internal services or exfiltrating sensitive data.

Technologies: [Apache Axis2\](https://junglewise.ai/threats/technologies/axis2). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-120832 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120832 being exploited in the wild.

**How severe is CVE-2026-120832?** Informational severity, published 9 November 2026.

**Which products and versions are affected?** Apache Axis2\ through 2.0.1.

**Is there a fix for CVE-2026-120832?** Yes: fixed in 2.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120832 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120832?** Check whether you run Apache Axis2\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.0.2

## Technical details

When Axis2 processes WSDL files via ServiceClient, AxisService.createClientSideAxisService, or WSDLToAxisServiceBuilder, it fetches absolute URLs from wsdl:import locations and xsd:import/xsd:include schemaLocations without validating the host or scheme; AAR and WAR deployment resolvers also pass unvalidated schema locations to the network. An attacker controlling the WSDL or schema can exploit this to force SSRF attacks. The issue is fixed in version 2.0.2.

## Affected products

- Apache Axis2 through 2.0.1

## Timeline

- 2026-11-09: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html](https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html)

## Related threats

- [Apache Axis2 XML External Entity injection in WSDL import resolution](https://junglewise.ai/threats/cve-2026-120761-improper-restriction-of-xml-external-entity-reference)
- [Apache Axis2 denial of service via unbounded JSON request buffering](https://junglewise.ai/threats/cve-2026-120367-allocation-of-resources-without-limits-or-throttling)