WSO2 API Manager CVE-2026-0637

Two conditions must simultaneously hold for exploitation to be possible: first, at least one Event Publisher output adapter must be configured with properties that are extraneous to the adapter's schema - this is a misconfiguration condition, not a default state; second, the attacker must have local, high-privileged read access to the wso2carbon log files on the host running the affected WSO2 product. The CVSS vector (AV:L/PR:H) confirms both constraints. Exploitation is limited by: (1) the requirement for a pre-existing misconfiguration of the Event Publisher adapter - correctly configured deployments do not trigger the logging behavior; (2) the need for local OS-level or administrative access to the log file path, ruling out remote unauthenticated attackers; and (3) the passive nature of the flaw - credentials are only logged when misconfigured adapters are invoked, not unconditionally. Deployments where Event Publisher is not used or is configured correctly are not affected.

The CVSS 3.1 base score of 4.4 Medium is calibrated by a local attack vector (AV:L) requiring high privileges (PR:H) - the attacker must already have OS-level or administrative read access to the wso2carbon log path. Despite the low score, the confidentiality impact is rated High (C:H) because the exposed data can include authentication credentials, enabling secondary compromise. EPSS data was not provided; given no KEV listing and no disclosed POC, opportunistic mass exploitation is not a current concern. The realistic threat profile is insider threat or post-compromise lateral movement: an attacker who has already achieved local system access or administrator-level credentials on the WSO2 host could harvest additional credentials from logs to pivot further. The 'Authentication Bypass' tag attached to this CVE is misleading - this is an information disclosure vulnerability (CWE-532) that could facilitate authentication bypass as a secondary outcome, not as a direct mechanism. Risk is moderate for organizations with shared WSO2 administrative access or insufficient log access controls; the specific trigger of an adapter misconfiguration limits exposure to environments where that misconfiguration exists.

An insider threat - such as a system administrator or a DevOps engineer with shell access to the WSO2 host - navigates to the wso2carbon log directory and searches log entries for Event Publisher adapter property names known to carry credential values, such as passwords or API keys that were inadvertently passed as unsupported adapter properties by a misconfigured deployment. The administrator extracts these credentials from log entries and uses them to authenticate to downstream services or APIs as a higher-privileged user, bypassing normal authorization flows. No public exploit code is required; standard command-line log parsing tools are sufficient once log file access is obtained.