CVE-2026-18800: 
WSO2 API Manager vulnerability analysis and mitigation

CVE-2026-18800 is an information disclosure vulnerability (CWE-532: Insertion of Sensitive Information into Log File) affecting multiple WSO2 products. When an Event Publisher output adapter is configured with properties irrelevant to its function, the affected products log those properties — potentially including sensitive user credentials or other confidential information — to the wso2carbon log files. The vulnerability was published on November 2, 2026, and affects WSO2 API Manager (3.1.0–4.6.0), WSO2 Identity Server (5.10.0–7.2.0), WSO2 Traffic Manager (4.5.0–4.6.0), WSO2 Universal Gateway (4.5.0–4.6.0), WSO2 API Control Plane (4.5.0–4.6.0), WSO2 Open Banking IAM (2.0.0), WSO2 Open Banking AM (2.0.0), WSO2 Identity Server as Key Manager (5.10.0), and the underlying org.wso2.carbon.event.publisher.core library. It carries a CVSS v3.1 base score of 4.4 (Medium) (GitHub Advisory, ENISA EUVD).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File). When an Event Publisher output adapter receives configuration properties that are not relevant to its intended function — for example, credentials or secrets passed as misconfigured adapter parameters — the WSO2 Carbon Event Publisher Core component logs those extraneous properties verbatim to the wso2carbon log files without sanitization or filtering. Exploitation requires that an attacker already have local access to the system's log files, which are typically accessible only to high-privileged users or system administrators. No public proof-of-concept code has been identified (GitHub Advisory, WSO2 Advisory).

The primary impact is a high confidentiality loss: a malicious actor with local, high-privileged access to wso2carbon log files could retrieve sensitive information such as user credentials, API keys, or other critical secrets inadvertently written to logs. This could enable unauthorized access to downstream systems or services if the exposed credentials are reused or have broad permissions. Integrity and availability are not affected by this vulnerability (GitHub Advisory, ENISA EUVD).

There is no evidence of active in-the-wild exploitation, no public proof-of-concept, and no exploit kit weaponization reported as of the disclosure date. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for local access with high privileges, making opportunistic exploitation unlikely (GitHub Advisory, ENISA EUVD).

1. Gain privileged local access: Obtain high-privileged local access to a system running a vulnerable WSO2 product (e.g., as a system administrator or via a compromised privileged account).
2. Identify misconfigured Event Publisher adapter: Locate an Event Publisher output adapter configuration that includes properties irrelevant to its function — for example, credentials or secrets passed as adapter parameters in the WSO2 management console or configuration files.
3. Trigger logging: Cause the Event Publisher to process events, which will prompt the Carbon Event Publisher Core to log the extraneous (misconfigured) properties, including any embedded credentials, to the wso2carbon log file.
4. Access log files: Navigate to the WSO2 product's log directory (typically <WSO2_HOME>/repository/logs/) and open wso2carbon.log.
5. Extract sensitive data: Search the log file for credential strings, tokens, or secrets that were inadvertently recorded, and use them for unauthorized access to other systems or services (GitHub Advisory, WSO2 Advisory).

• File System: Unexpected or unauthorized access to <WSO2_HOME>/repository/logs/wso2carbon.log or related rotated log files; log files copied or exfiltrated from the server.
• Logs: Entries in wso2carbon.log containing plaintext credential strings, passwords, tokens, or API keys associated with Event Publisher adapter configuration properties; log entries referencing adapter property names that are not standard for the configured output type.
• Process/Access: Unusual read access to WSO2 log directories by non-standard users or processes; audit log entries showing privileged users accessing log files outside of normal operational hours.

WSO2 has released patched versions for all affected products. Administrators should upgrade to: WSO2 API Manager 3.1.0.357+, 3.2.0.465+, 3.2.1.84+, 4.1.0.249+, 4.2.0.189+, 4.3.0.100+, 4.4.0.64+, 4.5.0.49+, or 4.6.0.13+; WSO2 Identity Server 5.10.0.386+, 5.11.0.433+, 6.0.0.260+, 6.1.0.261+, 7.0.0.139+, 7.1.0.47+, or 7.2.0.8+; WSO2 Traffic Manager 4.5.0.48+ or 4.6.0.13+; WSO2 Universal Gateway 4.5.0.49+ or 4.6.0.13+; WSO2 API Control Plane 4.5.0.50+ or 4.6.0.14+; WSO2 Open Banking IAM 2.0.0.426+; WSO2 Open Banking AM 2.0.0.406+; WSO2 Identity Server as Key Manager 5.10.0.377+; and org.wso2.carbon.event.publisher.core before 5.2.65 or 5.3.28+. As an interim measure, restrict read access to wso2carbon log files to only authorized personnel, and audit Event Publisher adapter configurations to remove any irrelevant or sensitive properties (WSO2 Advisory, GitHub Advisory).