EUVD-2026-39638
GHSA-r865-x64g-f9mm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network SSRF with low complexity and scope change into internal systems; primary impact is reading internal resources (C:H) with limited integrity effect and no inherent availability loss.
Primary rating from Vendor (WSO2).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests.
Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks.
AnalysisAI
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making server-initiated requests to attacker-chosen destinations by injecting crafted WS-Addressing headers into the message flow. Because the API Manager typically sits at the network edge with reachability into internal systems, this allows pivoting to otherwise unreachable internal resources and services. The vendor rates it CVSS 10.0; it is not in CISA KEV and no public exploit identified at time of analysis, with a low EPSS of 0.20% (10th percentile).
Technical ContextAI
WSO2 API Manager is an enterprise API gateway/management platform built on the WSO2 Carbon/Synapse mediation engine, which speaks SOAP and WS-* standards. WS-Addressing (the affected feature) is a SOAP header standard that carries routing metadata such as ReplyTo, FaultTo, and To endpoint references; the mediation/message-flow component uses these to direct server-initiated callbacks. The root cause is CWE-918 (Server-Side Request Forgery): user-controlled endpoint references inside WS-Addressing headers are not validated or restricted, so the server treats attacker-supplied URLs as legitimate destinations for its own outbound requests. CPE cpe:2.3:a:wso2:wso2_api_manager identifies the single affected product line.
RemediationAI
Patch available per vendor advisory WSO2-2026-5072: apply the patched WUM/update level for your release line - 3.1.0.360, 3.2.0.465, 3.2.1.84, 4.0.0.385, or 4.2.0.189 or later as applicable (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5072/). Until patched, the primary compensating control is to restrict outbound (egress) network access from the API Manager nodes so the gateway cannot reach internal management interfaces, cloud metadata endpoints (e.g. 169.254.169.254), or sensitive internal ranges - accepting that this may break legitimate integrations that call internal endpoints. Where WS-Addressing mediation is not required, disable or remove WS-Addressing handling in the relevant message flows/proxy services; if it is required, place the gateway behind an egress proxy with a destination allowlist. These controls reduce blast radius rather than fixing the validation flaw, so patching remains essential.
More in Wso2 Api Manager
View allAuthentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffi
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
Role-based access control bypass in WSO2 API Manager 3.x allows authenticated users with the 'Internal/Everyone' role to
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, AP
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthentic
WSO2 API Manager and API Control Plane use a non-cryptographic PRNG in the API Publisher component to generate shared se
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing opera
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today