by Kastro
Paper/Archive/CVE-2026-2053

CVE-2026-2053

WSO2 WSO2 API Manager — Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager

EPSS 0.4%CVSS 10.0
critical.is priorityof 100
37
CVSS 10.0 (NVD)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 33.6.336 × 206.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks.

Affected

ProductAffectedFixed inSource
WSO2 API Manager3.1.0 – < 3.1.0.3603.1.0.360CNA
WSO2 API Manager3.2.0 – < 3.2.0.4653.2.0.465CNA
WSO2 API Manager3.2.1 – < 3.2.1.843.2.1.84CNA
WSO2 API Manager4.0.0 – < 4.0.0.3854.0.0.385CNA
WSO2 API Manager4.2.0 – < 4.2.0.1894.2.0.189CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
WSO2 (CNA)8.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorysecurity.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5072