CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-2053 — The WSO2 API Manager's message flow component, when processing WS-Addressing hea...

·Source: NIST NVD

Updated:

Executive Summary

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of ser

Analysis

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks. CVSS Score: 8.3. Published: 2026-06-26T08:16:21.603.

Indicators of Compromise (1)

CVE (1)
CVE-2026-2053
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 26, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Anchorage Digital integrates with Lido to expand institutional access to Ethereum liquid staking

Anchorage Digital, home to America's first federally regulated crypto bank, has integrated with Lido, the largest liquid staking protocol on Ethereum, giving institutions compliant access to wstETH without leaving the Anchorage Digital platform.

Finextra
MEDIUMVulnerabilityNEW

Paysera becomes direct Visa member

Paysera LT, UAB has obtained the status of a direct Visa member (Issuing Principal Member) – one of the highest statuses in the payments industry.

Finextra
MEDIUMVulnerabilityNEW

Ondo Finance launches custodial tokenised securities in the US

Ondo Finance today announced the first live solution of third-party tokenized U.S. securities operating entirely within the existing regulatory perimeter in the U.S., in partnership with Broadridge Financial Solutions Inc., (NYSE: BR) to provide full voting rights for tokenized equity holders.

Finextra