WSO2 Carbon CVE-2026-18800

Two concrete preconditions must both hold: (1) an Event Publisher output adapter is configured with properties irrelevant to its function AND those properties contain credentials or other secrets, causing the product to write them into the 'wso2carbon' log files - a misconfiguration-dependent, non-default state; and (2) the attacker already has read access to those wso2carbon log files. Exploitation is limited by the need for high privileges / local log-file access (PR:H, AV:L), the requirement that the mislogged properties actually contain sensitive data, and the absence of any integrity or availability impact. There is no remote or unauthenticated path.

This is a genuinely low-to-moderate priority issue, consistent with its CVSS 4.4 (Medium) rating. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N makes the limited risk explicit: exploitation requires local access (AV:L) and high privileges (PR:H), i.e. an actor who can already read the 'wso2carbon' log files, with impact confined to confidentiality (C:H, I:N, A:N). The vulnerability (CWE-532, sensitive information in a log file) is not a direct network-exploitable flaw but an information-exposure condition that only matters when a misconfigured Event Publisher output adapter actually logs secrets. No EPSS score, SSVC exploitation/automatable/technical-impact metrics, or CISA KEV data were supplied, so exploitation probability cannot be quantified from the input. There is no public exploit identified at time of analysis - the only reference is the WSO2 vendor advisory, not PoC code. The vuln.today 'this_month' decision label signals routine patching urgency rather than emergency action, which aligns with the local/high-privilege precondition. One data conflict to note: the input Tag 'Authentication Bypass' does not match the described defect, which is log-based sensitive-information disclosure; the auth-bypass label is misleading and should be disregarded.

A WSO2 administrator misconfigures an Event Publisher output adapter with properties irrelevant to its function, and those properties contain credentials or other secrets, which the product then writes to the wso2carbon log files. A malicious insider or any actor who has obtained read access to those log files harvests the logged credentials and reuses them to gain unauthorized access elsewhere. No public exploit is required - the attack reduces to reading log files, but it depends on both a prior misconfiguration and existing privileged access to the logs.