{"id":8885,"date":"2026-11-13T15:23:19","date_gmt":"2026-11-13T15:23:19","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure"},"modified":"2026-11-13T15:23:19","modified_gmt":"2026-11-13T15:23:19","slug":"cve-2026-123779-apache-axis2-java-metadata-exposure","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-123779-apache-axis2-java-metadata-exposure","title":{"rendered":"CVE-2026-123779: Apache Axis2\/Java exposes service metadata despite exposeServiceMetadata setting"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What:<\/strong> Apache Axis2\/Java through 2.0.1 disclosed service metadata on multiple routes even when exposeServiceMetadata was set to false<\/li><li><strong>Who is affected:<\/strong> Deployments running Apache Axis2\/Java versions through 2.0.1 that rely on exposeServiceMetadata to hide service details<\/li><li><strong>Severity:<\/strong> Medium (CVSS 5.3)<\/li><li><strong>What to do:<\/strong> Upgrade to Apache Axis2\/Java version 2.0.2<\/li><li><strong>Status:<\/strong> Patch available<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">In plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Apache Axis2 is a web services framework used by developers to build SOAP-based applications. It has a setting called exposeServiceMetadata that is supposed to hide technical details about a service from anonymous visitors. However, this setting only worked on some routes, while other routes still disclosed operation names and data schemas even when the setting was turned off. Version 2.0.2 fixes this so the setting now works consistently across all routes. If you are an ordinary user who does not run web services, you can ignore this.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The exposeServiceMetadata service parameter in Apache Axis2\/Java was only enforced on the ?wsdl, ?wsdl2 and ?xsd query routes. For a service that had disabled this parameter, multiple other routes still disclosed metadata to anonymous callers:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Packaged .wsdl and .xsd file routes<\/li><li>Named-WSDL ?wsdl=NAME route of the standalone HTTP server<\/li><li>OpenAPI, Swagger UI and MCP catalog endpoints<\/li><li>The \/services\/ listing<\/li><li>WS-MetadataExchange GetMetadata<\/li><li>The ping module<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This metadata included operation names and request and response schemas. The vulnerability affects Apache Axis2\/Java through version 2.0.1.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">According to the release notes, the gate is now implemented in AxisService.isMetadataExposed() in the kernel, making it accessible to modules that answer anonymous metadata requests. Previously, the check was a private method in each HTTP transport, so modules could not reach it and did not apply the restriction.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The fix also addresses a separate issue where the ?xsd= route could reach any packaged META-INF resource, including services.xml, which contains parameters naming keystores and password-callback classes. The shared stream helper now serves only schema and WSDL documents.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Upgrade to Apache Axis2\/Java version 2.0.2, which fixes the issue. The release notes state that a service with exposure disabled is now skipped rather than refused on all routes, making it indistinguishable from one that is not deployed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The release notes also document that the ?wsdl, ?wsdl2, ?xsd and ?policy query routes still answer 403 for a hidden service where an undeployed one gets 404, which is an existence oracle. This is tracked for a follow-up fix.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What it means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This vulnerability allowed attackers to discover technical details about web services that administrators intended to keep private. While the CVSS score of 5.3 indicates medium severity, the exposure of operation names and schemas could aid reconnaissance for further attacks. Organizations that relied on exposeServiceMetadata to hide service details from anonymous callers were not protected on multiple routes until version 2.0.2.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-123779\" target=\"_blank\" rel=\"noreferrer noopener\">NVD CVE-2026-123779<\/a><\/li><li><a href=\"https:\/\/axis.apache.org\/axis2\/java\/core\/release-notes\/2.0.2.html\" target=\"_blank\" rel=\"noreferrer noopener\">Apache Axis2 2.0.2 Release Notes<\/a><\/li><li><a href=\"https:\/\/github.com\/apache\/axis-axis2-java-core\/commit\/1671a68660df39459bf22f7b00309e2a8e782117\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub commit 1671a68<\/a><\/li><li><a href=\"https:\/\/github.com\/apache\/axis-axis2-java-core\/commit\/8a81216b1b723e98a3c801de939201ad68f59b23\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub commit 8a81216<\/a><\/li><li><a href=\"https:\/\/lists.apache.org\/thread.html\/qqn6c4fb8tj0ldmb97c75zzxdjrh5dl3\" target=\"_blank\" rel=\"noreferrer noopener\">Apache mailing list thread<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Apache Axis2\/Java through 2.0.1 disclosed service metadata, including operation names and schemas, on multiple routes even when the exposeServiceMetadata parameter was disabled. Version 2.0.2 fixes the issue.<\/p>\n","protected":false},"author":2,"featured_media":8884,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"medium","_nx_sec_affected":"Apache Axis2\/Java through 2.0.1","_nx_sec_status":"patch-available","_nx_sec_kicker":"ALERT: Apache Axis2 metadata leak bypassed privacy control","_nx_sec_type":"platform","_nx_sec_vendor":"Apache Axis2","_nx_sec_fixed":"2.0.2","_nx_sec_action":""},"categories":[65,11,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-8885","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-security","category-infrastructure","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-123779: Apache Axis2 metadata exposure fixed<\/title>\n<meta name=\"description\" content=\"CVE-2026-123779 in Apache Axis2\/Java through 2.0.1 exposes service metadata on multiple routes even when exposeServiceMetadata is disabled. Upgrade to 2.0.2.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-123779: Apache Axis2 metadata exposure fixed\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-123779 in Apache Axis2\/Java through 2.0.1 exposes service metadata on multiple routes even when exposeServiceMetadata is disabled. Upgrade to 2.0.2.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-13T15:23:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-123779-apache-axis2-java-metadata-exposure-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123779-apache-axis2-java-metadata-exposure#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123779-apache-axis2-java-metadata-exposure\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-123779: Apache Axis2\\\/Java exposes service metadata despite exposeServiceMetadata setting\",\"datePublished\":\"2026-11-13T15:23:19+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123779-apache-axis2-java-metadata-exposure\"},\"wordCount\":485,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123779-apache-axis2-java-metadata-exposure#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123779-apache-axis2-java-metadata-exposure-title.webp\",\"articleSection\":[\"AI Security\",\"Infrastructure\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-13T15:23:19+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123779-apache-axis2-java-metadata-exposure\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123779-apache-axis2-java-metadata-exposure\",\"name\":\"CVE-2026-123779: Apache Axis2 metadata exposure fixed\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123779-apache-axis2-java-metadata-exposure#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123779-apache-axis2-java-metadata-exposure#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123779-apache-axis2-java-metadata-exposure-title.webp\",\"datePublished\":\"2026-11-13T15:23:19+00:00\",\"description\":\"CVE-2026-123779 in Apache Axis2\\\/Java through 2.0.1 exposes service metadata on multiple routes even when exposeServiceMetadata is disabled. Upgrade to 2.0.2.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123779-apache-axis2-java-metadata-exposure#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123779-apache-axis2-java-metadata-exposure\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123779-apache-axis2-java-metadata-exposure#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123779-apache-axis2-java-metadata-exposure-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123779-apache-axis2-java-metadata-exposure-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Image: AI-generated, i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123779-apache-axis2-java-metadata-exposure#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-123779: Apache Axis2\\\/Java exposes service metadata despite exposeServiceMetadata setting\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"},\"subjectOf\":[{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/papers.ssrn.com\\\/abstract=7426699\",\"name\":\"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/www.heise.de\\\/news\\\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html\",\"name\":\"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/t3n.de\\\/news\\\/bewerbung-schreiben-ki-5-fehler-1747190\\\/\",\"name\":\"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-123779: Apache Axis2 metadata exposure fixed","description":"CVE-2026-123779 in Apache Axis2\/Java through 2.0.1 exposes service metadata on multiple routes even when exposeServiceMetadata is disabled. Upgrade to 2.0.2.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-123779: Apache Axis2 metadata exposure fixed","og_description":"CVE-2026-123779 in Apache Axis2\/Java through 2.0.1 exposes service metadata on multiple routes even when exposeServiceMetadata is disabled. Upgrade to 2.0.2.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure","og_site_name":"i10X News","article_published_time":"2026-11-13T15:23:19+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-123779-apache-axis2-java-metadata-exposure-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_image":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-123779: Apache Axis2\/Java exposes service metadata despite exposeServiceMetadata setting","datePublished":"2026-11-13T15:23:19+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure"},"wordCount":485,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123779-apache-axis2-java-metadata-exposure-title.webp","articleSection":["AI Security","Infrastructure","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-13T15:23:19+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure","name":"CVE-2026-123779: Apache Axis2 metadata exposure fixed","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123779-apache-axis2-java-metadata-exposure-title.webp","datePublished":"2026-11-13T15:23:19+00:00","description":"CVE-2026-123779 in Apache Axis2\/Java through 2.0.1 exposes service metadata on multiple routes even when exposeServiceMetadata is disabled. Upgrade to 2.0.2.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123779-apache-axis2-java-metadata-exposure-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123779-apache-axis2-java-metadata-exposure-title.webp","width":1344,"height":768,"caption":"Image: AI-generated, i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123779-apache-axis2-java-metadata-exposure#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-123779: Apache Axis2\/Java exposes service metadata despite exposeServiceMetadata setting"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"},"subjectOf":[{"@type":"CreativeWork","url":"https:\/\/papers.ssrn.com\/abstract=7426699","name":"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens"},{"@type":"CreativeWork","url":"https:\/\/www.heise.de\/news\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html","name":"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT"},{"@type":"CreativeWork","url":"https:\/\/t3n.de\/news\/bewerbung-schreiben-ki-5-fehler-1747190\/","name":"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden"}]}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8885","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=8885"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8885\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/8884"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=8885"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=8885"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=8885"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=8885"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=8885"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}