CVE-2026-2053

Name of the Vulnerable Software and Affected Versions WSO2 API Manager (affected versions not specified)

Description The message flow component fails to sufficiently validate or restrict user-controlled input within WS-Addressing headers. This allows an unauthenticated attacker to manipulate these headers to specify arbitrary destinations for server-initiated requests, leading to Server-Side Request Forgery (SSRF). SSRF is a technique where an attacker induces a server-side application to make requests to an unintended location. This can enable unauthorized access to internal network resources or services that are typically inaccessible from external networks.

Recommendations Apply the latest security patches from WSO2.