---
id: "CVE-2026-2613"
kind: "vulnerability"
aliases: ["CVE-2026-2613"]
title: "WSO2 API Manager and related products: blind SQL injection in Admin REST API by administrators"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "WSO2 API Manager", "fixed": ["4.6.0 U15", "4.5.0 U51", "4.4.0 U66", "4.3.0 U102", "4.2.0 U191", "4.1.0 U251", "4.0.0 U387"], "affected": "4.0.0 - 4.6.0", "ecosystem": "vendor"}, {"name": "WSO2 API Control Plane", "fixed": ["4.6.0 U16", "4.5.0 U52"], "affected": "4.5.0, 4.6.0", "ecosystem": "vendor"}, {"name": "WSO2 Traffic Manager", "fixed": ["4.6.0 U15", "4.5.0 U50"], "affected": "4.5.0, 4.6.0", "ecosystem": "vendor"}, {"name": "WSO2 Universal Gateway", "fixed": ["4.6.0 U15", "4.5.0 U51"], "affected": "4.5.0, 4.6.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["admin-rest-api", "api-manager", "other", "self-hosted", "sql-injection", "wso2"]
not_affected_if: ["admin-api-not-exposed", "no-admin-rest-api-exposed"]
published_at: "2026-11-02T11:17:31+00:00"
first_seen_at: "2026-11-02T11:22:54+00:00"
updated_at: "2026-11-02T11:25:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2613", "first_seen_at": "2026-11-02T11:22:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T11:25:32+00:00"}]
---

# WSO2 API Manager and related products: blind SQL injection in Admin REST API by administrators

WSO2 advisory WSO2-2026-5100: the Admin REST API lets an authenticated administrator influence the structure of SQL statements, enabling blind SQL injection to infer database contents or affect database availability. CVSS 8.7. No exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WSO2 API Manager affected 4.0.0 - 4.6.0 fixed 4.6.0 U15, 4.5.0 U51, 4.4.0 U66, 4.3.0 U102, 4.2.0 U191, 4.1.0 U251, 4.0.0 U387
- vendor:WSO2 API Control Plane affected 4.5.0, 4.6.0 fixed 4.6.0 U16, 4.5.0 U52
- vendor:WSO2 Traffic Manager affected 4.5.0, 4.6.0 fixed 4.6.0 U15, 4.5.0 U50
- vendor:WSO2 Universal Gateway affected 4.5.0, 4.6.0 fixed 4.6.0 U15, 4.5.0 U51

## How to check

Check your WSO2 product and version (API Manager, API Control Plane, Traffic Manager, Universal Gateway). Affected: API Manager 4.0.0-4.6.0; API Control Plane, Traffic Manager, Universal Gateway 4.5.0 and 4.6.0. Subscribers: confirm your update level is at or above the fixed level listed in the advisory.

## Fix

Subscription holders: update to the update level in the advisory (API Manager 4.6.0 U15, 4.5.0 U51, 4.4.0 U66, 4.3.0 U102, 4.2.0 U191, 4.1.0 U251, 4.0.0 U387; Control Plane 4.6.0 U16, 4.5.0 U52; Traffic Manager 4.6.0 U15, 4.5.0 U50; Universal Gateway 4.6.0 U15, 4.5.0 U51). Community users: apply https://github.com/wso2/carbon-apimgt/pull/13624 or move to the latest unaffected release.

## Timeline

- 2026-11-02T11:22:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-2613
- 2026-11-02T11:25:32+00:00 analyst — Primary WSO2 advisory WSO2-2026-5100 read; affected products, update levels and public fix PR taken from it. Admin privileges required (PR:H). No exploitation or PoC found. Did not search social posts (low-profile, B tier).

## Documents

- [advisory] WSO2-2026-5100 / CVE-2026-2613 https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/
- [fix] carbon-apimgt PR 13624 https://github.com/wso2/carbon-apimgt/pull/13624

## From the sources

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements.

A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_