Live › vulnerability › CVE-2026-2613
WSO2 advisory WSO2-2026-5100: the Admin REST API lets an authenticated administrator influence the structure of SQL statements, enabling blind SQL injection to infer database contents or affect database availability. CVSS 8.7. No exploitation reported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 11:22 UTC. All times on this page are UTC.
Only accounts with administrator privileges can trigger it, according to the description, so exposure depends on who holds admin access to the affected Admin REST API. The sources do not name the affected product or versions, so the team cannot yet tell whether its systems run the flawed code.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WSO2 API Manager | vendor | 4.0.0 - 4.6.0 | 4.6.0 U15, 4.5.0 U51, 4.4.0 U66, 4.3.0 U102, 4.2.0 U191, 4.1.0 U251, 4.0.0 U387 |
| WSO2 API Control Plane | vendor | 4.5.0, 4.6.0 | 4.6.0 U16, 4.5.0 U52 |
| WSO2 Traffic Manager | vendor | 4.5.0, 4.6.0 | 4.6.0 U15, 4.5.0 U50 |
| WSO2 Universal Gateway | vendor | 4.5.0, 4.6.0 | 4.6.0 U15, 4.5.0 U51 |
4.0.0-4.6.0; API Control Plane, Traffic Manager, Universal Gateway 4.5.0 and 4.6.04.6.0 U15, 4.5.0 U51, 4.4.0 U66, 4.3.0 U102, 4.2.0 U191, 4.1.0 U251, 4.0.0 U387; Control Plane 4.6.0 U16, 4.5.0 U52; Traffic Manager 4.6.0 U15, 4.5.0 U50; Universal Gateway 4.6.0 U15, 4.5.0 U51)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements.
A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.
This page as .md · .json · in your agent: get_signal("CVE-2026-2613")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.