CVE-2026-2053: WSO2 API Manager SSRF via WS-Addressing Headers in Message Flow
CVE-2026-2053 affects the message flow component of WSO2 API Manager, which does not sufficiently validate user-controlled input in WS-Addressing headers, enabling Server-Side Request Forgery (CWE-918). The NVD assigns a CVSS 3.1 base score of 10.0 (Critical) with network attack vector and no privileges or user interaction required. Defenders should identify deployments within the listed affected ranges, consult the vendor advisory for fixed builds, and restrict outbound traffic from API Manager hosts to internal resources.
Overview
The WSO2 API Manager message flow component does not sufficiently validate or restrict user-controlled input in WS-Addressing headers. The weakness is classified as Server-Side Request Forgery (CWE-918), meaning the server may be steered into sending requests to destinations chosen by the sender.
Impact
- The NVD CVSS 3.1 base score is 10.0 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
- The record describes possible access to internal network resources or services that are normally unreachable from external networks.
- The record also lists a score of 8.3 (CVSS 3.1) from the CNA.
Affected products and versions
- The record lists WSO2 API Manager in these ranges: from 3.1.0 up to but excluding 3.1.0.360; from 3.2.0 up to but excluding 3.2.0.465; from 3.2.1 up to but excluding 3.2.1.84; from 4.0.0 up to but excluding 4.0.0.385; from 4.2.0 up to but excluding 4.2.0.189.
- The record contains no list of fixed versions. The vendor advisory should be consulted for the builds that address the issue.
Exploitation status
The record shows no CISA KEV listing (kev.listed is false). No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Inventory WSO2 API Manager deployments and compare their builds with the affected ranges listed above.
- Apply the fixes described in the vendor advisory WSO2-2026-5072.
- Until patching is complete, restrict outbound network access from API Manager hosts to internal address ranges and services that they do not require.
- Limit network exposure of message flow endpoints to trusted clients where feasible.
Detection guidance
- Review outbound connections originating from API Manager hosts, especially connections to internal addresses or unexpected services.
- Review inbound message traffic and logs for unusual WS-Addressing header content at a general level, and correlate with unexpected server-side requests.
Limitations of the available information
- The record has no fixed-version list, and the vendor advisory content was not available in the record itself.
- Technical details of the vulnerable code path, required configuration, and whether particular deployments are exposed are not stated.
- No independent exploitation reports are present in the sources consulted.
- Official references: NVD.
Frequently asked questions
What is the core weakness in CVE-2026-2053?
The message flow component does not sufficiently validate or restrict user-controlled input in WS-Addressing headers, which is classified as Server-Side Request Forgery (CWE-918).
Is authentication required to reach the vulnerable behavior?
The NVD vector lists no privileges required and no user interaction, so the record describes an unauthenticated network attacker.
Is there confirmed exploitation of this CVE?
The record shows no CISA KEV listing, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.