SQL Injection Vulnerability in WSO2 API due to Insufficient Input Sanitization
CVE-2026-2613

8.7HIGH

Key Information:

Vendor

Wso2

Status
Wso2 Api Manager
Wso2 Traffic Manager
Wso2 Api Control Plane
Wso2 Universal Gateway
Vendor
CVE Published:
2 November 2026

What is CVE-2026-2613?

The WSO2 API Manager contains a vulnerability wherein the Admin REST API inadequately sanitizes user-supplied input, allowing for SQL injection attacks. An attacker with administrator privileges can manipulate the structure of SQL statements, thereby executing blind SQL injection attacks. This flaw can grant the attacker access to sensitive database information and potentially disrupt the availability of the database service.

Affected Version(s)

WSO2 API Control Plane 4.5.0 < 4.5.0.52

WSO2 API Control Plane 4.6.0 < 4.6.0.16

WSO2 API Manager 4.0.0 < 4.0.0.387

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.