---
id: "CVE-2025-14260"
kind: "vulnerability"
aliases: ["CVE-2025-14260"]
title: "WSO2 product: unauthenticated SSRF lets attackers reach internal network resources"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "self-hosted", "wso2"]
not_affected_if: []
published_at: "2026-10-28T20:17:14+00:00"
first_seen_at: "2026-10-28T20:35:10+00:00"
updated_at: "2026-10-28T20:36:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14260", "first_seen_at": "2026-10-28T20:35:10+00:00"}]
---

# WSO2 product: unauthenticated SSRF lets attackers reach internal network resources

Some WSO2 products accept user-supplied resource locations without enforcing validation, so an unauthenticated attacker can make the server send requests to arbitrary internal or external addresses. An attacker can use this to reach internal services and filesystem resources the product can access, potentially exposing sensitive data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Identify which WSO2 product and version is deployed (the sources do not name the affected product or versions)
- Check the WSO2 advisory referenced by NVD for the affected product list: https://nvd.nist.gov/vuln/detail/CVE-2025-14260

## Fix

- unknown: the sources do not name the fixed version or the patch. Check the WSO2 security advisory for the affected product and upgrade to the patched release.

## Timeline

- 2026-10-28T20:35:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-14260

## From the sources

Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations.

Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_