EUVD-2026-53820
GHSA-q9jj-jm6w-fpgf
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Local attack vector and high privileges required because exploitation demands filesystem read access to wso2carbon logs; confidentiality High as credentials may be exposed; no integrity or availability impact.
Primary rating from Vendor (WSO2).
CVSS VectorVendor: WSO2
Lifecycle Timeline
2DescriptionCVE.org
When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values.
A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information, such as user credentials or other confidential data, that was inadvertently logged due to misconfiguration, potentially leading to unauthorized access.
AnalysisAI
Sensitive information disclosure in WSO2's Carbon Event Publisher Core affects nine WSO2 platform products, including API Manager, Identity Server, and Open Banking components. When an Event Publisher output adapter is misconfigured with extraneous or irrelevant properties, those property values - which may include user credentials or confidential data - are written to the wso2carbon log files without sanitization or masking (CWE-532). A local, high-privileged actor with read access to those log files can extract the inadvertently logged secrets and leverage them for unauthorized access. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability resides in the WSO2 Carbon Event Publisher Core component (cpe:2.3:a:wso2:wso2_carbon_event_publisher_core), a shared subsystem consumed across the WSO2 middleware platform. Event Publisher output adapters allow platform operators to route analytics or event data to external endpoints; each adapter accepts a typed property schema. When an operator configures properties outside that schema - so-called 'irrelevant properties' - the framework logs the full key-value pair to the wso2carbon log file without redacting or validating the values. CWE-532 (Insertion of Sensitive Information into Log File) describes exactly this root cause: application logging that inadvertently captures secrets because the logging layer does not differentiate between safe diagnostic data and sensitive runtime values. The affected product set spans API management (WSO2 API Manager, Traffic Manager, API Control Plane, Universal Gateway), identity and access management (WSO2 Identity Server, Identity Server as Key Manager), and regulated open banking deployments (WSO2 Open Banking IAM and AM).
RemediationAI
Apply the vendor-released patch per WSO2 Security Advisory WSO2-2025-4897, available at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/. The exact patched versions are not independently confirmed from the available input data - operators must consult the advisory directly to identify the minimum safe version for each affected product. As a compensating control, audit all Event Publisher output adapter configurations and remove any extraneous or unsupported properties that are not required by the adapter schema; eliminating the misconfiguration removes the trigger condition entirely. Additionally, enforce strict access controls on the wso2carbon log directory, limiting read access to only authorized system administrators via filesystem permissions (chmod 640 or equivalent) and centralised log management with role-based access. Note that restricting log access does not remediate the root cause but substantially reduces the exposure window by limiting who can read inadvertently logged secrets. Rotate any credentials that may have been written to logs prior to remediation.
More in Wso2 Api Manager
View allAuthentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making ser
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffi
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
Role-based access control bypass in WSO2 API Manager 3.x allows authenticated users with the 'Internal/Everyone' role to
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, AP
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthentic
WSO2 API Manager and API Control Plane use a non-cryptographic PRNG in the API Publisher component to generate shared se
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today