CVE-2026-2053
Full vulnerability record from the local CVENow database.
Description
The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks.
Severity
CRITICAL
CVSS score
10.0
(v3.1)
Vulnerability status
Analyzed
Source identifier
ed10eef1-636d-4fbe-9993-6890dfa878f8
Published
2026-06-26 08:16:21.603000
Last modified
2026-10-25 22:10:00.150000
View original CVE JSON
{
"id": "CVE-2026-2053",
"sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"published": "2026-06-26T08:16:21.603",
"lastModified": "2026-10-25T22:10:00.150",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests.\n\nSuccessful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks."
},
{
"lang": "es",
"value": "El componente de flujo de mensajes de WSO2 API Manager, al procesar los encabezados WS-Addressing, no valida ni restringe suficientemente la entrada controlada por el usuario dentro de estos encabezados. Esta omisión permite a un atacante manipular los encabezados WS-Addressing para especificar destinos arbitrarios para las solicitudes iniciadas por el servidor.\n\nLa explotación exitosa permite a un atacante no autenticado controlar el destino de las solicitudes iniciadas por el servidor que se originan desde WSO2 API Manager. Este control directo puede permitir el acceso no autorizado a recursos o servicios de red internos que normalmente serían inaccesibles desde redes externas."
}
],
"affected": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"affectedData": [
{
"vendor": "WSO2",
"product": "WSO2 API Manager",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "3.1.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "3.1.0",
"lessThan": "3.1.0.360",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.0",
"lessThan": "3.2.0.465",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.1",
"lessThan": "3.2.1.84",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.0.0",
"lessThan": "4.0.0.385",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.2.0",
"lessThan": "4.2.0.189",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 3.7
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-26T16:09:25.936561Z",
"id": "CVE-2026-2053",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.1.0",
"versionEndExcluding": "3.1.0.360",
"matchCriteriaId": "60B6A3E5-97A4-4F91-A365-AE8AF31E1E23"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.0",
"versionEndExcluding": "3.2.0.465",
"matchCriteriaId": "7F679042-FF0E-42DF-AA01-EC1571D5234F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.1",
"versionEndExcluding": "3.2.1.84",
"matchCriteriaId": "ECFD7993-2946-4750-A0B9-8CB7AEC01C22"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.0.0",
"versionEndExcluding": "4.0.0.385",
"matchCriteriaId": "D96F7BA9-9516-4704-A73D-FB349F56814E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.2.0",
"versionEndExcluding": "4.2.0.189",
"matchCriteriaId": "C1C2B451-1076-44AA-99C5-B42938BED88A"
}
]
}
]
}
],
"references": [
{
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5072/",
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"tags": [
"Vendor Advisory"
]
}
]
}