Read the docs
TI-2026-83777 Aliases CVE-2026-18800GHSA-xf2f-qhmc-c4c4

Multiple WSO2 products log sensitive data through Event Publisher

Priority LOW 20CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

Several WSO2 products, including WSO2 API Manager, WSO2 Traffic Manager, WSO2 Identity Server and other products, log irrelevant properties when an Event Publisher output adapter is configured with them. The logged properties can include sensitive user credentials or other confidential information. A local attacker with high privileges who can read the wso2carbon log files can retrieve that data, a flaw classified as CWE-532.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00161 5th percentileScored 2026-11-07
Fix Fixed WSO2 API Manager (WSO2): 3.1.0.357, 3.2.0.465, 3.2.1.84 +6WSO2 Traffic Manager (WSO2): 4.5.0.48, 4.6.0.13+7 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 API Manager3.1.0 to before 3.1.0.357; 3.2.0 to before 3.2.0.465; 3.2.1 to before 3.2.1.84; 4.1.0 to before 4.1.0.249; 4.2.0 to before 4.2.0.189; 4.3.0 to before 4.3.0.100; 4.4.0 to before 4.4.0.64; 4.5.0 to before 4.5.0.49; 4.6.0 to before 4.6.0.133.1.0.357, 3.2.0.465, 3.2.1.84, 4.1.0.249, 4.2.0.189, 4.3.0.100, 4.4.0.64, 4.5.0.49, 4.6.0.13Patch availableCNA
WSO2WSO2 Traffic Manager4.5.0 to before 4.5.0.48; 4.6.0 to before 4.6.0.134.5.0.48, 4.6.0.13Patch availableCNA
WSO2WSO2 API Control Plane4.5.0 to before 4.5.0.50; 4.6.0 to before 4.6.0.144.5.0.50, 4.6.0.14Patch availableCNA
WSO2WSO2 Universal Gateway4.5.0 to before 4.5.0.49; 4.6.0 to before 4.6.0.134.5.0.49, 4.6.0.13Patch availableCNA
WSO2WSO2 Identity Server5.10.0 to before 5.10.0.386; 5.11.0 to before 5.11.0.433; 6.0.0 to before 6.0.0.260; 6.1.0 to before 6.1.0.261; 7.0.0 to before 7.0.0.139; 7.1.0 to before 7.1.0.47; 7.2.0 to before 7.2.0.85.10.0.386, 5.11.0.433, 6.0.0.260, 6.1.0.261, 7.0.0.139, 7.1.0.47, 7.2.0.8Patch availableCNA
WSO2WSO2 Identity Server as Key Manager5.10.0 to before 5.10.0.3775.10.0.377Patch availableCNA
WSO2WSO2 Open Banking IAM2.0.0 to before 2.0.0.4262.0.0.426Patch availableCNA
WSO2WSO2 Open Banking AM2.0.0 to before 2.0.0.4062.0.0.406Patch availableCNA
WSO2WSO2 Carbon Event Publisher Corebefore 5.2.65; 5.3.0 to before 5.3.285.2.65, 5.3.28Patch availableCNA
  • WSO2 API Manager VendorWSO2 Affected 3.1.0 to before 3.1.0.357; 3.2.0 to before 3.2.0.465; 3.2.1 to before 3.2.1.84; 4.1.0 to before 4.1.0.249; 4.2.0 to before 4.2.0.189; 4.3.0 to before 4.3.0.100; 4.4.0 to before 4.4.0.64; 4.5.0 to before 4.5.0.49; 4.6.0 to before 4.6.0.13 Fixed in 3.1.0.357, 3.2.0.465, 3.2.1.84, 4.1.0.249, 4.2.0.189, 4.3.0.100, 4.4.0.64, 4.5.0.49, 4.6.0.13 Patch available CNA
  • WSO2 Traffic Manager VendorWSO2 Affected 4.5.0 to before 4.5.0.48; 4.6.0 to before 4.6.0.13 Fixed in 4.5.0.48, 4.6.0.13 Patch available CNA
  • WSO2 API Control Plane VendorWSO2 Affected 4.5.0 to before 4.5.0.50; 4.6.0 to before 4.6.0.14 Fixed in 4.5.0.50, 4.6.0.14 Patch available CNA
  • WSO2 Universal Gateway VendorWSO2 Affected 4.5.0 to before 4.5.0.49; 4.6.0 to before 4.6.0.13 Fixed in 4.5.0.49, 4.6.0.13 Patch available CNA
  • WSO2 Identity Server VendorWSO2 Affected 5.10.0 to before 5.10.0.386; 5.11.0 to before 5.11.0.433; 6.0.0 to before 6.0.0.260; 6.1.0 to before 6.1.0.261; 7.0.0 to before 7.0.0.139; 7.1.0 to before 7.1.0.47; 7.2.0 to before 7.2.0.8 Fixed in 5.10.0.386, 5.11.0.433, 6.0.0.260, 6.1.0.261, 7.0.0.139, 7.1.0.47, 7.2.0.8 Patch available CNA
  • WSO2 Identity Server as Key Manager VendorWSO2 Affected 5.10.0 to before 5.10.0.377 Fixed in 5.10.0.377 Patch available CNA
  • WSO2 Open Banking IAM VendorWSO2 Affected 2.0.0 to before 2.0.0.426 Fixed in 2.0.0.426 Patch available CNA
  • WSO2 Open Banking AM VendorWSO2 Affected 2.0.0 to before 2.0.0.406 Fixed in 2.0.0.406 Patch available CNA
  • WSO2 Carbon Event Publisher Core VendorWSO2 Affected before 5.2.65; 5.3.0 to before 5.3.28 Fixed in 5.2.65, 5.3.28 Patch available CNA

CPE names Threatist (inferred) · 2

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*——WSO2
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*——WSO2
  • cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* Versions — — ·WSO2
  • cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* Versions — — ·WSO2

Remediation

Fixed in WSO2 API Manager 3.1.0.357, 3.2.0.465, 3.2.1.84, 4.1.0.249, 4.2.0.189, 4.3.0.100, 4.4.0.64, 4.5.0.49 and 4.6.0.13; Traffic Manager 4.5.0.48 and 4.6.0.13; API Control Plane 4.5.0.50 and 4.6.0.14; Universal Gateway 4.5.0.49 and 4.6.0.13; Identity Server 5.10.0.386, 5.11.0.433, 6.0.0.260, 6.1.0.261, 7.0.0.139, 7.1.0.47 and 7.2.0.8; Identity Server as Key Manager 5.10.0.377; Open Banking IAM 2.0.0.426; Open Banking AM 2.0.0.406; Carbon Event Publisher Core 5.2.65 and 5.3.28.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA WSO2 API Manager (WSO2) Fixed in 3.1.0.357, 3.2.0.465, 3.2.1.84, 4.1.0.249, 4.2.0.189, 4.3.0.100, 4.4.0.64, 4.5.0.49, 4.6.0.13
  • Fix · CNA WSO2 Traffic Manager (WSO2) Fixed in 4.5.0.48, 4.6.0.13
  • Fix · CNA WSO2 API Control Plane (WSO2) Fixed in 4.5.0.50, 4.6.0.14
  • Fix · CNA WSO2 Universal Gateway (WSO2) Fixed in 4.5.0.49, 4.6.0.13
  • Fix · CNA WSO2 Identity Server (WSO2) Fixed in 5.10.0.386, 5.11.0.433, 6.0.0.260, 6.1.0.261, 7.0.0.139, 7.1.0.47, 7.2.0.8
  • Fix · CNA WSO2 Identity Server as Key Manager (WSO2) Fixed in 5.10.0.377
  • Fix · CNA WSO2 Open Banking IAM (WSO2) Fixed in 2.0.0.426
  • Fix · CNA WSO2 Open Banking AM (WSO2) Fixed in 2.0.0.406
  • Fix · CNA WSO2 Carbon Event Publisher Core (WSO2) Fixed in 5.2.65, 5.3.28

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-18800
  2. 2026-11-02 Alias added: GHSA-xf2f-qhmc-c4c4
  3. 2026-11-02 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
  • TI-2022-11928 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-18808 An issue was discovered in WSO2 Enterprise Integrator 6.4.0. CVSS 3.1MEDIUM 6.1
  • TI-2020-15069 The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0… CVSS 3.1CRITICAL 9.1
  • TI-2023-15163 A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do… CVSS 3.1MEDIUM 6.1
  • TI-2022-04130 WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting CVSS 3.1MEDIUM 6.1
See all 186 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences