CVE-2026-2053

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5072/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:wso2:api_manager::::::::
	cpe:2.3:a:wso2:api_manager::::::::
	cpe:2.3:a:wso2:api_manager::::::::
	cpe:2.3:a:wso2:api_manager::::::::
	cpe:2.3:a:wso2:api_manager::::::::

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El componente de flujo de mensajes de WSO2 API Manager, al procesar los encabezados WS-Addressing, no valida ni restringe suficientemente la entrada controlada por el usuario dentro de estos encabezados. Esta omisión permite a un atacante manipular los encabezados WS-Addressing para especificar destinos arbitrarios para las solicitudes iniciadas por el servidor. La explotación exitosa permite a un atacante no autenticado controlar el destino de las solicitudes iniciadas por el servidor que se originan desde WSO2 API Manager. Este control directo puede permitir el acceso no autorizado a recursos o servicios de red internos que normalmente serían inaccesibles desde redes externas.

Information

Published : 2026-06-26 08:16

Updated : 2026-10-25 22:10

NVD link : CVE-2026-2053

Mitre link : CVE-2026-2053

CVE.ORG link : CVE-2026-2053

JSON object : View

Products Affected

wso2

api_manager

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-2053", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2053", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T16:09:25.936561Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.1.0", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.0.360", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.465", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.84", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.385", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.189", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-26T08:16:21.603", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5072/", "tags": ["Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests.\n\nSuccessful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks."}, {"lang": "es", "value": "El componente de flujo de mensajes de WSO2 API Manager, al procesar los encabezados WS-Addressing, no valida ni restringe suficientemente la entrada controlada por el usuario dentro de estos encabezados. Esta omisi\u00f3n permite a un atacante manipular los encabezados WS-Addressing para especificar destinos arbitrarios para las solicitudes iniciadas por el servidor.\n\nLa explotaci\u00f3n exitosa permite a un atacante no autenticado controlar el destino de las solicitudes iniciadas por el servidor que se originan desde WSO2 API Manager. Este control directo puede permitir el acceso no autorizado a recursos o servicios de red internos que normalmente ser\u00edan inaccesibles desde redes externas."}], "lastModified": "2026-10-25T22:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60B6A3E5-97A4-4F91-A365-AE8AF31E1E23", "versionEndExcluding": "3.1.0.360", "versionStartIncluding": "3.1.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F679042-FF0E-42DF-AA01-EC1571D5234F", "versionEndExcluding": "3.2.0.465", "versionStartIncluding": "3.2.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ECFD7993-2946-4750-A0B9-8CB7AEC01C22", "versionEndExcluding": "3.2.1.84", "versionStartIncluding": "3.2.1"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D96F7BA9-9516-4704-A73D-FB349F56814E", "versionEndExcluding": "4.0.0.385", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1C2B451-1076-44AA-99C5-B42938BED88A", "versionEndExcluding": "4.2.0.189", "versionStartIncluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}