CVE-2026-2053 Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager

High 8.3 Published 26 Jun 2026 Updated 26 Jun 2026

Unauthenticated attackers can exploit WS-Addressing header validation flaws to force the server to make requests to arbitrary internal or external destinations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-2053?

CVE-2026-2053 is a high-severity server-side request forgery vulnerability in Wso2 Api Manager, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests.

Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks.

Weakness: CWE-918

Which versions are affected by CVE-2026-2053?

It affects 1 product.

Products include Wso2 Api Manager.

How do I fix CVE-2026-2053?

No fix has been published for CVE-2026-2053 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-2053 being exploited?

There is no known exploitation of CVE-2026-2053 in the wild and no public exploit code.

All Wso2 Api Manager vulnerabilities

Sources

Also known as GHSA-r865-x64g-f9mm.