Additional Authentication on CXF Services list

Question

In penetration test we got an issue on CXF services list where we are listing all available SOAP and REST services along with WS