Log in / Sign up

Vulnerability details

CVE-2026-2053

WSO2 API Manager

Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager

CVSS 3.1
8.3High

Official description

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks.

CVSS scores

ScoreVersionSourceVector
8.3High 3.1 CVEProject cvelistV5 (CNA) (WSO2) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Affected products

VendorProductVersionsSource
WSO2 WSO2 API Manager v < 3.1.0 CVEProject cvelistV5 (CNA)
WSO2 WSO2 API Manager 3.1.0 ≤ v < 3.1.0.360 CVEProject cvelistV5 (CNA)
WSO2 WSO2 API Manager 3.2.0 ≤ v < 3.2.0.465 CVEProject cvelistV5 (CNA)
WSO2 WSO2 API Manager 3.2.1 ≤ v < 3.2.1.84 CVEProject cvelistV5 (CNA)
WSO2 WSO2 API Manager 4.0.0 ≤ v < 4.0.0.385 CVEProject cvelistV5 (CNA)
WSO2 WSO2 API Manager 4.2.0 ≤ v < 4.2.0.189 CVEProject cvelistV5 (CNA)

References and advisories

1
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-06-26
Last updated
2026-06-26
State
Published
Assigner (CNA)
WSO2

Exploit prediction (EPSS)

0.39%
Probability of exploitation in 30 days
33.7%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
None
Technical impact
Partial

Weaknesses (CWE)

  • CWE-918
    Server-Side Request Forgery (SSRF)