WSO2 Multiple Products Path Traversal Vulnerability
TL;DR 📌
- WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.
- Highest CVSS: 10.0 (Critical).
- Listed in CISA KEV (2026-09-24) — this is being exploited in the wild.
- Fixed in
4.1.0.257,4.2.0.197,4.3.0.108,4.4.0.72— upgrade to this release or later. - CVEs: CVE-2026-5430.
What it is
CVE-2026-5430 affects several WSO2 products: API Control Plane, API Manager, Traffic Manager and Universal Gateway. WSO2’s summary describes it as a path traversal flaw permitting unrestricted file upload with a route to remote code execution.
The NVD description gives a different technical mechanism: the JWT authentication component accepts tokens signed with algorithms other than those explicitly configured or supported. An attacker can craft a JWT using an unsupported algorithm that is then incorrectly validated, resulting in unauthorised access. NVD states this can lead to compromise of administrative accounts and full account takeover.
The vulnerability requires no authentication and no user interaction, and is reachable over the network (AV:N/PR:N/UI:N). The base CVSS score is 10.0, reflecting a scope change (S:C) — meaning compromise here can affect resources beyond the vulnerable component itself. NVD notes the score is adjusted to 9.8 in single-tenant deployments, where the impact stays within one security authority boundary.
This CVE is listed in the CISA Known Exploited Vulnerabilities catalogue, added on 2026-09-24.
What to do
- Patch to the fixed versions identified for your product line: 4.1.0.257, 4.2.0.197, 4.3.0.108, 4.4.0.72, 4.5.0.56, 4.5.0.57, 4.5.0.58, 4.6.0.21, or 4.6.0.22, depending on which release train you run. Match the fix to your current minor version rather than assuming the latest listed applies.
- Given the CISA KEV listing, treat this as immediate patching priority rather than routine maintenance.
- Review JWT validation configuration on affected gateways and control planes — confirm only explicitly supported signing algorithms are accepted, and check whether your deployment is multi-tenant (higher scope of impact per NVD) or single-tenant.
- Check API Manager, Traffic Manager, Universal Gateway and API Control Plane logs for JWTs signed with unexpected algorithms or authentication events that bypassed normal token validation.
- Audit administrative accounts on affected instances for unexpected creation, privilege changes, or logins following the KEV addition date, since NVD flags administrative account compromise as a specific outcome.
For leadership 🧭
Executive summary. WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway will accept authentication tokens signed with algorithms they were never configured to trust, giving an unauthenticated network attacker a route to full administrative account takeover. This is already listed as actively exploited, so it needs treating as an emergency patch rather than something for the next maintenance cycle.
Why it matters:
- The flaw sits in JWT authentication on internet-facing API gateway and control plane components, meaning exploitation requires no credentials and no user interaction (AV:N/PR:N/UI:N).
- NVD flags administrative account compromise and full account takeover as the specific consequence, which for an API management platform means control over routing, policy and every API it fronts.
- The scope change (S:C) in the base score means a compromised token can affect resources beyond the vulnerable component itself, so multi-tenant deployments carry higher exposure than the 9.8 single-tenant figure NVD quotes.
- This CVE is in the CISA KEV catalogue as of 24 September 2026, so it is being used, not just theoretically exploitable.
Now / Next / Later:
- Now: Check logs on API Manager, Traffic Manager, Universal Gateway and API Control Plane for JWTs signed with unexpected algorithms or authentication events that bypassed normal validation, and audit administrative accounts for unexpected creation, privilege changes or logins since the KEV date.
- Next: Patch each affected instance to the fixed build matching its release train (4.1.0.257, 4.2.0.197, 4.3.0.108, 4.4.0.72, 4.5.0.56/57/58, or 4.6.0.21/22), prioritising internet-facing gateways and multi-tenant deployments first.
- Later: Lock down JWT validation configuration to explicitly whitelist supported signing algorithms only, and record whether each deployment is single- or multi-tenant so future scope-of-impact assessments are immediate rather than reactive.