CVE-2026-2053 is a high severity server side request forgery flaw (CVSS 8.3) in WSO2 API Manager. The message flow component does not restrict user controlled WS-Addressing headers, so an unauthenticated attacker could choose where server initiated requests go. WSO2's advisory WSO2-2026-5072 lists the fix.
What's affected
WSO2 API Manager is named in the record. The record does not list versions. WSO2's advisory WSO2-2026-5072 is the source for the affected product versions and the updates or patches to apply.
How to check if you're exposed
Check your API Manager version in the management console or your deployment files, and compare it with the advisory. Also check whether your gateway accepts SOAP or message flows that use WS-Addressing headers.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- List WSO2 API Manager deployments and versions.
- Read advisory WSO2-2026-5072 and apply the update it names.
- Add egress controls so the gateway cannot reach internal services or cloud metadata addresses it does not need.
- Review gateway logs for outbound requests to unexpected internal destinations.
Why it matters
Server side request forgery, CWE-918, turns a trusted server into a proxy for the attacker. The record says user controlled input in WS-Addressing headers could set arbitrary destinations for requests the server makes. The damage is access to internal resources that are not reachable from outside.
The record notes no authentication is needed, and the vector has a changed scope. Gateways often sit between the internet and internal systems, which makes this class worth taking seriously. The CVE is not in CISA's KEV list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do attackers need an account?
No. The record says unauthenticated.
Does an egress rule replace the patch?
No, but it limits what a request to an internal address can reach.
Sources
Last reviewed: 19 October 2026.
