Sensitive Information Exposure in WSO2 Event Publisher by WSO2
CVE-2026-18800

4.4MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Api Manager
Wso2 Traffic Manager
Wso2 Api Control Plane
Wso2 Universal Gateway
Vendor
CVE Published:
2 November 2026

What is CVE-2026-18800?

The WSO2 Event Publisher can inadvertently log irrelevant configuration properties, which may include sensitive user credentials or confidential data. When misconfigured properties are present, these logs can become accessible to malicious actors, exposing potentially critical information. Unauthorized access risks arise particularly when credentials or sensitive secrets are logged, emphasizing the importance of proper configuration and security measures.

Affected Version(s)

WSO2 API Control Plane 4.5.0 < 4.5.0.50

WSO2 API Control Plane 4.6.0 < 4.6.0.14

WSO2 API Manager 3.1.0 < 3.1.0.357

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.