CVE-2026-5430

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-5430 10.0

WSO2 · Multiple Products · Added 2026-09-24 · Published 2026-08-06

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityWSO2 Multiple Products Path Traversal Vulnerability

VendorWSO2

ProductMultiple Products

Date added2026-09-24

Due date2026-09-27

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-347

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Descriptions

KEV: WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.

NVD: The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-24 19:40 UTC

Wall time0.5s

Searches1

Component defaultyes

Sources https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
https://thehackernews.com/2026/09/active-exploitation-attempts-target.html
https://www.sentinelone.com/vulnerability-database/CVE-2026-5430/
https://github.com/fankh/vulnerability-poc/tree/main/2026/CVE-2026-5430
https://github.com/advisories/GHSA-j7vh-5w8q-4m4x
https://github.com/wso2/carbon-apimgt/pull/13752
https://github.com/wso2/docs-apim/blob/master/en/docs/api-security/runtime/api-authentication/api-authentication-overview.md
https://github.com/wso2/docs-apim/blob/master/en/docs/api-security/key-management/tokens/jwt-tokens.md
https://www.cve.org/CVE-2026-5430
https://nvd.nist.gov/vuln/detail/CVE-2026-5430

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

Hunting hypothesis agent

Hunt access logs for Bearer JWTs to WSO2 API Manager paths like /api/v1/me whose header decodes to alg=none with an empty signature dot; WAF or custom log capture is required because stock access logs omit the Authorization header.

Research details

Componentcarbon-apimgt JWT signature validation — JWTUtil.verifyTokenSignature and OAuthAuthenticationInterceptor in the apimgt REST API auth path

PreconditionsUnauthenticated remote network access to a vulnerable WSO2 deployment validating JWTs: API Manager 4.1.0-4.6.0, API Control Plane 4.5.0/4.6.0, Traffic Manager 4.5.0/4.6.0, Universal Gateway 4.5.0/4.6.0; no credentials or user interaction required; fix via public PRs or subscription update levels. agent

DeliveryBearer JWT in the Authorization header sent to WSO2 API Manager/gateway REST endpoints

Public PoCyes

PoC URLs https://github.com/fankh/vulnerability-poc/tree/main/2026/CVE-2026-5430 Third-party repos; verify before use.

Advisoryhttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0). Public PoC (fankh/vulnerability-poc) is detection/verification tooling — sends alg=none and empty-signature Bearer JWTs to common API paths and ships a Docker vulnerable/patched demo lab — not weaponized WSO2 exploit code. watchTowr observed in-the-wild exploitation, with honeypot-captured forged-admin JWTs on 2026-09-13 (The Hacker News).

SummaryWSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway accept JWTs signed with algorithms outside the configured set in the carbon-apimgt JWT validation path, letting unauthenticated attackers forge administrator tokens for full account takeover (CWE-347, CVSS 10.0). Vendor advisory WSO2-2026-5328 (2026-05-03) provides public fix PRs for community users and update levels for subscription holders across API Manager 4.1.0-4.6.0. watchTowr reported in-the-wild exploitation attempts with forged-admin JWTs on 2026-09-13, and CISA added the CVE to KEV on 2026-09-24 with a 2026-09-27 due date.

Tia coverage

First reported2026-08-11

First exploit report2026-09-16

Exploit report → KEV8 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-adds-exploited-wso2-adobe-commerce-sharepoint-and-routeros cve-2026-5430-cvss-9-8-critical-jwt-auth-bypass-in-wso2-api-mana

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.