CVE-2026-0637

Summary

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values.

A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information, such as user credentials or other confidential data, that was inadvertently logged due to misconfiguration, potentially leading to unauthorized access.

Affected Software

VendorProductVersion RangeStatus
WSO2WSO2 API Manager0 < 3.1.0unknown
WSO2WSO2 API Manager3.1.0 < 3.1.0.357affected
WSO2WSO2 API Manager3.2.0 < 3.2.0.465affected
WSO2WSO2 API Manager3.2.1 < 3.2.1.84affected
WSO2WSO2 API Manager4.1.0 < 4.1.0.249affected
WSO2WSO2 API Manager4.2.0 < 4.2.0.189affected
WSO2WSO2 API Manager4.3.0 < 4.3.0.100affected
WSO2WSO2 API Manager4.4.0 < 4.4.0.64affected
WSO2WSO2 API Manager4.5.0 < 4.5.0.49affected
WSO2WSO2 API Manager4.6.0 < 4.6.0.13affected
WSO2WSO2 Traffic Manager0 < 4.5.0unknown
WSO2WSO2 Traffic Manager4.5.0 < 4.5.0.48affected
WSO2WSO2 Traffic Manager4.6.0 < 4.6.0.13affected
WSO2WSO2 API Control Plane0 < 4.5.0unknown
WSO2WSO2 API Control Plane4.5.0 < 4.5.0.50affected
WSO2WSO2 API Control Plane4.6.0 < 4.6.0.14affected
WSO2WSO2 Universal Gateway0 < 4.5.0unknown
WSO2WSO2 Universal Gateway4.5.0 < 4.5.0.49affected
WSO2WSO2 Universal Gateway4.6.0 < 4.6.0.13affected
WSO2WSO2 Identity Server0 < 5.10.0unknown
WSO2WSO2 Identity Server5.10.0 < 5.10.0.386affected
WSO2WSO2 Identity Server5.11.0 < 5.11.0.433affected
WSO2WSO2 Identity Server6.0.0 < 6.0.0.260affected
WSO2WSO2 Identity Server6.1.0 < 6.1.0.261affected
WSO2WSO2 Identity Server7.0.0 < 7.0.0.139affected
WSO2WSO2 Identity Server7.1.0 < 7.1.0.47affected
WSO2WSO2 Identity Server7.2.0 < 7.2.0.8affected
WSO2WSO2 Identity Server as Key Manager0 < 5.10.0unknown
WSO2WSO2 Identity Server as Key Manager5.10.0 < 5.10.0.377affected
WSO2WSO2 Open Banking IAM0 < 2.0.0unknown
WSO2WSO2 Open Banking IAM2.0.0 < 2.0.0.426affected
WSO2WSO2 Open Banking AM0 < 2.0.0unknown
WSO2WSO2 Open Banking AM2.0.0 < 2.0.0.406affected
WSO2WSO2 Carbon Event Publisher Core5.2.24 < 5.2.24.11affected
WSO2WSO2 Carbon Event Publisher Core5.2.26 < 5.2.26.24affected
WSO2WSO2 Carbon Event Publisher Core5.2.27 < 5.2.27.7affected
WSO2WSO2 Carbon Event Publisher Core5.2.41 < 5.2.41.8affected
WSO2WSO2 Carbon Event Publisher Core5.2.45 < 5.2.45.2affected
WSO2WSO2 Carbon Event Publisher Core5.2.50 < 5.2.50.3affected
WSO2WSO2 Carbon Event Publisher Core5.2.57 < 5.2.57.12affected
WSO2WSO2 Carbon Event Publisher Core5.2.58 < 5.2.58.3affected
WSO2WSO2 Carbon Event Publisher Core5.2.61 < 5.2.61.4affected
WSO2WSO2 Carbon Event Publisher Core5.2.64 < 5.2.64.1affected
WSO2WSO2 Carbon Event Publisher Core5.3.5 < 5.3.5.10affected
WSO2WSO2 Carbon Event Publisher Core5.3.11 < 5.3.11.7affected
WSO2WSO2 Carbon Event Publisher Core5.3.15 < 5.3.15.6affected
WSO2WSO2 Carbon Event Publisher Core5.3.20 < 5.3.20.3affected
WSO2WSO2 Carbon Event Publisher Core5.3.27 < 5.3.27.1affected
WSO2WSO2 Carbon Event Publisher Corex <= *unaffected

Weaknesses

  • CWE-532: CWE-532: Insertion of Sensitive Information into Log Files

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References