CVE-2026-2053 – Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager

CVE ID :CVE-2026-2053

Published : June 26, 2026, 7:26 a.m. | 18 minutes ago

Description :The WSO2 API Manager’s message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests.

Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks.

Severity: 8.3 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…