VULNERABILITY INTELLIGENCE

CVE-2026-2053

CVSS score8.3 HIGH
EPSS probability0.39%
CISA KEVNot currently listed
Published2026-06-26
Last modified2026-10-25
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Description

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks.

Weakness classification

  • ed10eef1-636d-4fbe-9993-6890dfa878f8: CWE-918

Primary references