HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation

Summary

In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.

Timeline

1. May 11, 2026, 9:30 AM UTCCVE published
2. May 11, 2026, 12:43 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. May 11, 2026, 12:43 PM UTCRecord last updated

Affected versions

• WSO2 WSO2 API Manager

  From 4.1.0 · fixed in 4.1.0.218; From 4.2.0 · fixed in 4.2.0.164; From 4.3.0 · fixed in 4.3.0.74; From 4.4.0 · fixed in 4.4.0.38; From 4.5.0 · fixed in 4.5.0.20

• WSO2 WSO2 Universal Gateway

  From 4.5.0 · fixed in 4.5.0.19

• WSO2 WSO2 Traffic Manager

  From 4.5.0 · fixed in 4.5.0.19

• WSO2 WSO2 API Control Plane

  From 4.5.0 · fixed in 4.5.0.21

• org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.gateway

  From 9.20.74 · fixed in 9.20.74.374; From 9.28.116 · fixed in 9.28.116.363; From 9.29.120 · fixed in 9.29.120.181; From 9.30.67 · fixed in 9.30.67.104; From 9.31.86 · fixed in 9.31.86.64

• org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl

  From 9.20.74 · fixed in 9.20.74.374; From 9.28.116 · fixed in 9.28.116.363; From 9.29.120 · fixed in 9.29.120.181; From 9.30.67 · fixed in 9.30.67.104; From 9.31.86 · fixed in 9.31.86.64

References 1