CVE-2026-2053Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager

Descripción

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5072/ vendor-advisoryVendor Advisory