WSO2 API Manager Unauthenticated SSRF via WS-Addressing (CVE-2026-2053) Security Advisory

Vulnerability Overview Vulnerability Name: Security Advisory WSO2-2026-5072/CVE-2026-2053 Release Date: 2026-05-03 Version: 1.0.0 Severity: High CVSS Score: 8.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) CVE ID: CVE-2026-2053 Affected Products Affected Product: WSO2 API Manager: 4.2.0, 4.0.0, 3.2.1, 3.2.0, 3.1.0 Remediation Description: In deployments where custom handlers or configurations trigger message building prior to the main mediation sequence (e.g., via user-defined global Synapse handlers), the WS-Addressing headers may be processed at an early stage of message handling. Under these conditions, the WS-Addressing headers provided in the incoming request can influence the destination of requests initiated by the server. An unauthenticated attacker can exploit this behavior by providing carefully crafted header values to control the destination of server-initiated requests. This may lead to unauthorized access to internal network resources or services that are not directly accessible from the external network. Impact Impact: Successful exploitation of this vulnerability allows an unauthenticated attacker to control the destination of server-initiated requests. This may result in unauthorized access to internal network resources or services that are not directly accessible from the external network. Additional Information Community Users: Open Source Support Subscription Holders: Supported Page Navigation Security Advisory: WSO2-2026-5072 Other Related Advisories: WSO2-2026-5328, WSO2-2026-5236, WSO2-2026-5212, WSO2-2026-5146, WSO2-2026-5100, WSO2-2026-5077, WSO2-2026-5059, WSO2-2026-5051, WSO2-2026-5039, WSO2-2026-5002, WSO2-2026-5001, WSO2-2025-4973, WSO2-2025-4918, WSO2-2025-4897, WSO2-2025-4891, WSO2-2025-4849, WSO2-2025-4829, WSO2-2025-4800, WSO2-2025-4771, WSO2-2025-4751, WSO2-2025-4733, WSO2-2025-4731, WSO2-2025-4727, WSO2-2025-4684, WSO2-2025-4672 Right Sidebar Navigation Affected Product: WSO2 API Manager Overview: Unauthenticated Server-Side Request Forgery (SSRF) in WS-Addressing Description: In deployments where custom handlers or configurations trigger message building prior to the main mediation sequence (e.g., via user-defined global Synapse handlers), the WS-Addressing headers may be processed at an early stage of message handling. Under these conditions, the WS-Addressing headers provided in the incoming request can influence the destination of requests initiated by the server. An unauthenticated attacker can exploit this behavior by providing carefully crafted header values to control the destination of server-initiated requests. This may lead to unauthorized access to internal network resources or services that are not directly accessible from the external network. Impact: Successful exploitation of this vulnerability allows an unauthenticated attacker to control the destination of server-initiated requests. This may result in unauthorized access to internal network resources or services that are not directly accessible from the external network. Solution: Community Users (Open Source) Support Subscription Holders: Supported Footer Report a Security Issue: Report a Security Issue Header Navigation Bar: Security Process, Security Guidelines, Security Advisories, Security Reporting Search Box: Search Left Sidebar Security Advisories: WSO2 Security Advisories 2026 Advisories: WSO2-2026-5328, WSO2-2026-5236, WSO2-2026-5212, WSO2-2026-5146, WSO2-2026-5100, WSO2-2026-5077, WSO2-2026-5059, WSO2-2026-5051, WSO2-2026-5039, WSO2-2026-5002, WSO2-2026-5001, WSO2-2025-4973, WSO2-2025-4918, WSO2-2025-4897, WSO2-2025-4891, WSO2-2025-4849, WSO2-2025-4829, WSO2-2025-4800, WSO2-2025-4771, WSO2-2025-4751, WSO2-2025-4733, WSO2-2025-4731, WSO2-2025-4727, WSO2-2025-4684, WSO2-2025-4672

Goal Reached Thanks to every supporter — we hit 100%!

WSO2 API Manager Unauthenticated SSRF via WS-Addressing (CVE-2026-2053) Security Advisory