External risk intelligence

WSO2 API Manager WS-Addressing Header Destination Control Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-2053

WSO2 API Manager is an enterprise-grade gateway and API management platform explicitly designed to be deployed as an internet-facing service to manage and expose APIs to external clients and partners. Its primary purpose involves handling incoming traffic at the network edge, making it inherently public-facing by design.

Server-Side Request Forgery

Wso2 Api Manager

3.1.0 to before 3.1.0.3603.2.0 to before 3.2.0.4653.2.1 to before 3.2.1.844.0.0 to before 4.0.0.3854.2.0 to before 4.2.0.189

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in WSO2 API Manager allows unauthenticated attackers to manipulate WS-Addressing headers, potentially controlling the destination of server-initiated requests and gaining unauthorized access to internal resources. This issue affects the message flow component when processing these specific headers.

Attackers can redirect server requests.
Protects against unauthorized internal access.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can leverage the WSO2 API Manager's message flow component by manipulating WS-Addressing headers. This manipulation allows them to redirect server-initiated requests to arbitrary destinations, potentially granting them unauthorized access to internal network resources.

Network access is required.
Manipulate WS-Addressing headers.
Unauthorized access to internal resources.

Live Threat

Current exploitation, exposure, and threat context

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager, potentially enabling unauthorized access to internal network resources or services.

Internal network resources could be exposed.
Server-initiated requests may be redirected.
Unauthorized access to internal services is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in WSO2 API Manager, allowing attackers to control server-initiated requests, likely falls under the responsibility of the platform or infrastructure teams managing the API gateway. The initial step is to identify all WSO2 API Manager instances, confirm their exposure and criticality, and then assign ownership for remediation.

Platform or infrastructure teams own the issue.
Verify all WSO2 API Manager instances.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WSO2 API Manager?

WSO2 API Manager is an enterprise-grade platform used by organizations to create, publish, and manage application programming interfaces (APIs). It acts as a gateway that sits between backend services and external clients, ensuring that API traffic is routed, secured, and monitored. Because it is designed to manage interactions between different software systems, it often handles complex messaging protocols, including those involved in routing and addressing server requests.

What does CVE-2026-2053 mean for the software?

This vulnerability is classified as Server-Side Request Forgery (CWE-918). It occurs because the software fails to properly validate input provided in WS-Addressing headers. In plain English, the system can be tricked into using its own internal authority to send requests to destinations chosen by an attacker, rather than where the system intended to send them.

How does an attacker trigger this vulnerability?

An unauthenticated attacker triggers this by sending specially crafted messages containing manipulated WS-Addressing headers to the API Manager. It is important to note that this bug specifically concerns the server's outward-facing request flow; it is not triggered by standard API calls that do not utilize these specific addressing headers, nor does it require existing user credentials to initiate the manipulation.

Is my WSO2 API Manager instance at risk?

According to Halo Surface Signal, WSO2 API Manager is typically deployed as an internet-facing gateway to handle external traffic, which significantly increases the risk profile for this vulnerability. Because the software is designed to sit at the network edge, any instance exposed to the public internet is at a much higher likelihood of being reachable by an attacker compared to instances strictly isolated within an internal network.

What are the first steps to address this?

Begin by auditing your environment to locate all active WSO2 API Manager deployments. Once identified, consult the official security advisory provided by WSO2 to determine the specific patch or configuration update required for your version. Coordinate with your platform or infrastructure team to prioritize these updates, as they are the primary stakeholders responsible for maintaining the security of the API gateway infrastructure.

References

security.docs.wso2.com/en/latest/security-announcements/security-advisories/…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.