{"id":"CVE-2026-5430","kind":"vulnerability","aliases":["CVE-2026-5430"],"related":[],"title":"The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or…","description":"WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway have a path traversal flaw that lets an attacker write uploaded files to arbitrary locations. The sources say this can lead to remote code execution, and CISA reports it is being exploited in the wild.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-09-24T00:00:00+00:00","products":[{"name":"WSO2 Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"WSO2 API Manager","fixed":["4.6.0 L21","4.5.0 L57","4.4.0 L72","4.3.0 L108","4.2.0 L197","4.1.0 L257"],"affected":"4.1.0 to 4.6.0","ecosystem":"vendor"},{"name":"WSO2 API Control Plane","fixed":["4.6.0 L22","4.5.0 L58"],"affected":"4.5.0, 4.6.0","ecosystem":"vendor"},{"name":"WSO2 Traffic Manager","fixed":["4.6.0 L21","4.5.0 L56"],"affected":"4.5.0, 4.6.0","ecosystem":"vendor"},{"name":"WSO2 Universal Gateway","fixed":["4.6.0 L21","4.5.0 L57"],"affected":"4.5.0, 4.6.0","ecosystem":"vendor"},{"name":"wso2 api control plane","fixed":["4.5.0.58"],"affected":">= 4.5.0, < 4.5.0.58","ecosystem":"vendor"},{"name":"wso2 api control plane","fixed":["4.6.0.22"],"affected":">= 4.6.0, < 4.6.0.22","ecosystem":"vendor"},{"name":"wso2 api manager","fixed":["4.1.0.257"],"affected":">= 4.1.0, < 4.1.0.257","ecosystem":"vendor"},{"name":"wso2 api manager","fixed":["4.2.0.197"],"affected":">= 4.2.0, < 4.2.0.197","ecosystem":"vendor"},{"name":"wso2 api manager","fixed":["4.3.0.108"],"affected":">= 4.3.0, < 4.3.0.108","ecosystem":"vendor"},{"name":"wso2 api manager","fixed":["4.4.0.72"],"affected":">= 4.4.0, < 4.4.0.72","ecosystem":"vendor"},{"name":"wso2 api manager","fixed":["4.5.0.57"],"affected":">= 4.5.0, < 4.5.0.57","ecosystem":"vendor"},{"name":"wso2 api manager","fixed":["4.6.0.21"],"affected":">= 4.6.0, < 4.6.0.21","ecosystem":"vendor"},{"name":"wso2 traffic manager","fixed":["4.5.0.56"],"affected":">= 4.5.0, < 4.5.0.56","ecosystem":"vendor"},{"name":"wso2 traffic manager","fixed":["4.6.0.21"],"affected":">= 4.6.0, < 4.6.0.21","ecosystem":"vendor"},{"name":"wso2 universal gateway","fixed":["4.5.0.57"],"affected":">= 4.5.0, < 4.5.0.57","ecosystem":"vendor"},{"name":"wso2 universal gateway","fixed":["4.6.0.21"],"affected":">= 4.6.0, < 4.6.0.21","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["api-gateway","api-manager","auth-bypass","exploited","jwt","self-hosted","vendor","wso2"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the installed WSO2 product version against the affected ranges (API Manager 4.1.0 to 4.6.0, API Control Plane 4.5.0 and 4.6.0, Traffic Manager 4.5.0 and 4.6.0, Universal Gateway 4.5.0 and 4.6.0).","fix":"Update to the fixed update level for your release line: API Manager 4.6.0 L21, 4.5.0 L57, 4.4.0 L72, 4.3.0 L108, 4.2.0 L197, 4.1.0 L257; API Control Plane 4.6.0 L22 or 4.5.0 L58; Traffic Manager 4.6.0 L21 or 4.5.0 L56; Universal Gateway 4.6.0 L21 or 4.5.0 L57.","status":"resolved","published_at":"2026-08-06T08:16:33+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T22:30:17+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:30:17Z","model":"claude-haiku-5-5","output":{"fix":"Update to the fixed update level for your release line: API Manager 4.6.0 L21, 4.5.0 L57, 4.4.0 L72, 4.3.0 L108, 4.2.0 L197, 4.1.0 L257; API Control Plane 4.6.0 L22 or 4.5.0 L58; Traffic Manager 4.6.0 L21 or 4.5.0 L56; Universal Gateway 4.6.0 L21 or 4.5.0 L57.","reach":"internet","title":"WSO2 API Manager and gateways: path traversal enables file upload and code execution","impact":"high","summary":"WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway have a path traversal flaw that lets an attacker write uploaded files to arbitrary locations. The sources say this can lead to remote code execution, and CISA reports it is being exploited in the wild.","category":"vendor","who_cares":["wso2","api-manager","api-gateway","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs code on the server and reads secrets","analyst_note":"Confirm the exact preconditions for the upload path and whether unauthenticated access is needed; check the vendor advisory linked from the CISA KEV entry.","how_to_check":"Check the installed WSO2 product version against the affected ranges (API Manager 4.1.0 to 4.6.0, API Control Plane 4.5.0 and 4.6.0, Traffic Manager 4.5.0 and 4.6.0, Universal Gateway 4.5.0 and 4.6.0).\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000656,"input_tokens":3407,"output_tokens":631,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find WSO2's advisory for CVE-2026-5430 to get affected and fixed versions, the endpoint involved, and any detection indicators.","search":"'-04':182C,208C,239C '-2026':16A,19A '-5430':17A,20A '26':181C,207C,238C 'accept':5A 'accord':171C 'action':167C 'adher':235C 'algorithm':9A 'allow':154C 'api':25A,28A,38A,42A,46A,49A,52A,55A,58A,61A,76B,79B,92B,95B,138C,141C 'api-gateway':75B 'api-manag':78B 'appli':168C 'applic':205C 'arbitrari':115B 'asset':229C 'attack':110B 'auth':82B 'auth-bypass':81B 'authent':3A 'base':186C 'bod':180C,206C,237C 'bypass':83B 'cisa':128B,165C,178C,195C 'cloud':211C 'code':125B,163C 'complianc':176C 'configur':14A 'contain':147C 'control':29A,39A,43A,93B,139C 'could':153C 'cve':15A,18A 'discontinu':214C 'ensur':175C,234C 'evalu':227C 'execut':126B,164C 'explicit':13A 'exploit':84B,133B 'exposur':232C 'file':113B,157C 'flaw':106B 'follow':204C 'forens':197C 'gateway':36A,71A,74A,77B,101B,146C 'guidanc':193C,209C 'guidelin':241C 'host':88B 'instruct':174C 'internet':231C 'jwt':2A,85B 'lead':122B,160C 'let':108B 'locat':116B 'manag':80B,96B,98B,142C,144C 'manager':26A,33A,47A,50A,53A,56A,59A,62A,65A,68A 'mechan':4A 'mitig':169C,220C 'multiple':22A 'note':192C,203C 'patch':240C 'path':104B,149C 'plane':30A,40A,44A,94B,140C 'priorit':183C 'product':218C 'products':23A 'remot':124B,162C 'report':129B 'requir':166C,199C 'respons':225C 'risk':188C 'say':119B 'secur':184C 'see':189C,200C 'self':87B 'self-host':86B 'servic':212C 'sign':7A 'sourc':118B 'stakehold':223C 'token':6A 'traffic':32A,64A,67A,97B,143C 'travers':105B,150C 'triag':198C 'unavail':222C 'univers':100B,145C 'universal':35A,70A,73A 'unrestrict':156C 'updat':185C 'upload':112B,158C 'url':190C,201C 'use':215C 'vendor':89B,173C 'vulner':151C 'wild':136B 'write':111B 'wso2':21A,24A,27A,31A,34A,37A,41A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,90B,91B,137C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-03T00:00:00+00:00","kev":{"dateAdded":"2026-09-24","dueDate":"2026-09-27","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-5430","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430","severity":null,"published_at":"2026-09-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T14:39:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-5430:1","url":null,"severity":null,"published_at":"2026-10-23T20:03:34+00:00","modified_at":"2026-10-23T20:03:34+00:00","first_seen_at":"2026-10-23T20:03:34+00:00","fetched_at":"2026-10-23T20:03:34+00:00","note":"WSO2 advisory WSO2-2026-5328 read: flaw is JWT auth bypass, not path traversal as CISA KEV titles it; versions and update levels from vendor; exploitation per CISA KEV 2026-09-24; PoC and exploit details unknown."},{"source":"analyst","external_id":"CVE-2026-5430:83","url":null,"severity":null,"published_at":"2026-10-23T21:27:47+00:00","modified_at":"2026-10-23T21:27:47+00:00","first_seen_at":"2026-10-23T21:27:47+00:00","fetched_at":"2026-10-23T21:27:47+00:00","note":"Re-read vendor advisory WSO2-2026-5328: flaw is JWT auth bypass (unsupported signing algorithm), CVSS 10 (9.8 single-tenant); CISA KEV title 'path traversal' does not match the vendor description. Exploitation per CISA KEV 2026-09-24; public PoC/IOCs unknown, not in advisory."},{"source":"nvd","external_id":"CVE-2026-5430","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5430","severity":null,"published_at":"2026-08-06T08:16:33+00:00","modified_at":"2026-09-25T12:53:05+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1,"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/","title":"WSO2-2026-5328 / CVE-2026-5430 vendor advisory","kind":"advisory","source":"analyst","text":"WSO2 advisory WSO2-2026-5328/CVE-2026-5430, May 3 2026, CVSS 10. JWT auth bypass when token signed with unsupported algorithm. Affected: API Control Plane 4.6.0,4.5.0; API Manager 4.1.0-4.6.0; Traffic Manager 4.6.0,4.5.0; Universal Gateway 4.6.0,4.5.0. Fix update levels: ACP 4.6.0 L22, 4.5.0 L58; APIM 4.6.0 L21, 4.5.0 L57, 4.4.0 L72, 4.3.0 L108, 4.2.0 L197, 4.1.0 L257; TM 4.6.0 L21, 4.5.0 L56; UG 4.6.0 L21, 4.5.0 L57. Community fixes: github.com/wso2/carbon-apimgt/pull/13752, github.com/wso2/product-apim/pull/14167. Credit: Hacktron.","published_at":"2026-05-03T00:00:00+00:00","relation":"advisory","confidence":0.9,"note":"Vendor advisory: affected versions, update levels, fix PRs"},{"id":2,"url":"https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog","title":"CISA adds CVE-2026-5430 to KEV (Sep 24 2026)","kind":"advisory","source":"analyst","text":"CISA added CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability to KEV on 2026-09-24 based on evidence of active exploitation.","published_at":"2026-09-24T00:00:00+00:00","relation":"mentions","confidence":0.9,"note":"CISA KEV addition 2026-09-24"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}