{"id":"CVE-2025-14260","kind":"vulnerability","aliases":["CVE-2025-14260"],"related":[],"title":"WSO2 product: unauthenticated SSRF lets attackers reach internal network resources","description":"Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations.\n\nExploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.","summary":"Some WSO2 products accept user-supplied resource locations without enforcing validation, so an unauthenticated attacker can make the server send requests to arbitrary internal or external addresses. An attacker can use this to reach internal services and filesystem resources the product can access, potentially exposing sensitive data.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","self-hosted","wso2"],"not_affected_if":[],"how_to_check":"- Identify which WSO2 product and version is deployed (the sources do not name the affected product or versions)\n- Check the WSO2 advisory referenced by NVD for the affected product list: https://nvd.nist.gov/vuln/detail/CVE-2025-14260","fix":"- unknown: the sources do not name the fixed version or the patch. Check the WSO2 security advisory for the affected product and upgrade to the patched release.","status":"open","published_at":"2026-10-28T20:17:14+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","triaged_at":"2026-10-28T20:36:09+00:00","updated_at":"2026-10-28T20:36:09+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-28T20:36:09Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name the fixed version or the patch. Check the WSO2 security advisory for the affected product and upgrade to the patched release.","reach":"internet","title":"WSO2 product: unauthenticated SSRF lets attackers reach internal network resources","impact":"high","summary":"Some WSO2 products accept user-supplied resource locations without enforcing validation, so an unauthenticated attacker can make the server send requests to arbitrary internal or external addresses. An attacker can use this to reach internal services and filesystem resources the product can access, potentially exposing sensitive data.","category":"infrastructure","nicknames":[],"who_cares":["wso2","self-hosted"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker reaches internal services and reads sensitive data from the network","analyst_note":"Identify the affected WSO2 products, versions and fixed releases from the WSO2 advisory and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-14260.","how_to_check":"- Identify which WSO2 product and version is deployed (the sources do not name the affected product or versions)\n- Check the WSO2 advisory referenced by NVD for the affected product list: https://nvd.nist.gov/vuln/detail/CVE-2025-14260","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running a WSO2 product that accepts resource location input on an exposed endpoint are potentially affected. The sources do not say which WSO2 products or configurations are vulnerable, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000633,"input_tokens":3375,"output_tokens":592,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-14260':13A,16A '-2025':12A,15A 'accept':25B,82C 'access':65B,76C,123C,148C 'actor':103C,121C 'address':49B 'allow':118C 'arbitrari':45B,112C 'attack':6A,37B,51B 'avail':129C 'constraint':95C 'control':77C 'could':143C 'cve':11A,14A 'data':69B,151C 'direct':105C 'due':70C 'enforc':32B,92C 'expect':93C 'exploit':99C,115C 'expos':67B 'extern':48B,127C 'filesystem':60B,134C 'host':20B 'implement':74C 'improp':73C 'infrastructur':17B 'input':86C 'intern':8A,46B,57B,125C 'lead':145C 'let':5A 'locat':30B,90C,114C 'make':39B,109C 'malici':120C 'network':9A,113C,132C 'potenti':66B,144C 'product':2A,24B,63B,81C,141C 'reach':7A,56B 'reachabl':137C 'relat':87C 'request':43B,110C 'resourc':10A,29B,61B,89C,128C 'rule':78C 'self':19B 'self-host':18B 'send':42B 'sensit':68B,150C 'server':41B,107C 'servic':58B 'ssrf':4A 'suppli':28B,85C 'system':153C 'unauthent':3A,36B,102C 'unauthor':147C 'use':53B 'user':27B,84C 'user-suppli':26B,83C 'valid':33B,94C 'vulner':117C 'without':31B,91C 'wso2':1A,21B,23B,80C,140C","nicknames":[],"mitigations":[],"who_affected":"Teams running a WSO2 product that accepts resource location input on an exposed endpoint are potentially affected. The sources do not say which WSO2 products or configurations are vulnerable, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T20:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-14260","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14260","severity":null,"published_at":"2026-10-28T20:17:14+00:00","modified_at":"2026-10-28T20:17:14+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","fetched_at":"2026-10-28T20:35:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}