Live › vulnerability › CVE-2026-4052
In WSO2 Identity Server deployments configured as a Resident Key Manager with database sharing, a self-registered user can get a token from the Identity Server token endpoint. That token can then be used to access the System REST APIs of WSO2 API Manager.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 08:19 UTC. All times on this page are UTC.
Only WSO2 API Manager 4.1.0 to 4.6.0 (and API Control Plane 4.5.0/4.6.0) deployments that use WSO2 Identity Server as a Resident Key Manager with a shared database are exposed. There, a self-registered user can get a token from the Identity Server token endpoint and call API Manager's System REST APIs, potentially taking over an admin account. Deployments with another key manager or without database sharing can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WSO2 API Manager | vendor | 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0 (only with WSO2 Identity Server as Resident Key Manager with database sharing) | latest U2 update level + updated IS connector |
| WSO2 API Control Plane | vendor | 4.5.0, 4.6.0 | latest U2 update level + updated IS connector |
Per WSO2: update Identity Server and API Manager to the latest U2 update level; download the latest WSO2 IS connector (APIM docs, Step 4 of Configuring WSO2 Identity Server as a Key Manager); replace wso2is.key.manager.core and wso2is.notification.event.handlers jars in repository/components/dropins; remove old keymanager-operations.war and directory from repository/deployment/server/webapps and add the new war; restart IS.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.
This page as .md · .json · in your agent: get_signal("CVE-2026-4052")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.