Public vulnerability disclosure
CVE-2026-2613
SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption
publishedCWE-89
The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.
Technical severity8.7 highCVSS 3.1 · CNA: WSO2
Published2026-11-02Source updated 2026-11-02
Collected2026-11-022 attributed sources
Fixes and workarounds
Fix
Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/#solution
Source: CNA: WSO2Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| WSO2 API Manager WSO2 |
≥ 0; < 4.0.0 (unknown, custom) ≥ 4.0.0; < 4.0.0.387 (affected, custom) ≥ 4.1.0; < 4.1.0.251 (affected, custom) ≥ 4.2.0; < 4.2.0.191 (affected, custom) ≥ 4.3.0; < 4.3.0.102 (affected, custom) ≥ 4.4.0; < 4.4.0.66 (affected, custom) ≥ 4.5.0; < 4.5.0.51 (affected, custom) ≥ 4.6.0; < 4.6.0.15 (affected, custom) Other versions: unaffected |
CNA: WSO2 |
| WSO2 Traffic Manager WSO2 |
≥ 0; < 4.5.0 (unknown, custom) ≥ 4.5.0; < 4.5.0.50 (affected, custom) ≥ 4.6.0; < 4.6.0.15 (affected, custom) Other versions: unaffected |
CNA: WSO2 |
| WSO2 API Control Plane WSO2 |
≥ 0; < 4.5.0 (unknown, custom) ≥ 4.5.0; < 4.5.0.52 (affected, custom) ≥ 4.6.0; < 4.6.0.16 (affected, custom) Other versions: unaffected |
CNA: WSO2 |
| WSO2 Universal Gateway WSO2 |
≥ 0; < 4.5.0 (unknown, custom) ≥ 4.5.0; < 4.5.0.51 (affected, custom) ≥ 4.6.0; < 4.6.0.15 (affected, custom) Other versions: unaffected |
CNA: WSO2 |
| WSO2 Carbon API Management Implementation WSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl
|
≥ 0; < 9.33.25 (affected, custom)
Other versions: unaffected |
CNA: WSO2 |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 8.7 high |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H | CNA: WSO2 |
| 3.1 / 8.7 high |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H | NVD: ed10eef1-636d-4fbe-9993-6890dfa878f8 |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/CNA: WSO2 · vendor-advisory
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/ed10eef1-636d-4fbe-9993-6890dfa878f8