CVE-2026-5430

WSO2 Multiple Products Path Traversal Vulnerability

10.0 CRITICALActively exploited (CISA KEV)EPSS 0.59%

Published6 Aug 2026
Added to CISA KEV24 Sept 2026
Remediation due27 Sept 2026

Description

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Wso2 API Control Plane≥ 4.5.0 < 4.5.0.58 · ≥ 4.6.0 < 4.6.0.22

Wso2 API Manager≥ 4.1.0 < 4.1.0.257 · ≥ 4.2.0 < 4.2.0.197 · ≥ 4.3.0 < 4.3.0.108 · ≥ 4.4.0 < 4.4.0.72

Wso2 Traffic Manager≥ 4.5.0 < 4.5.0.56 · ≥ 4.6.0 < 4.6.0.21

Wso2 Universal Gateway≥ 4.5.0 < 4.5.0.57 · ≥ 4.6.0 < 4.6.0.21

Remediation

Fixed in

Wso2 API Control Plane≥ 4.5.0.58

Wso2 API Manager≥ 4.1.0.257

Wso2 Traffic Manager≥ 4.5.0.56

Wso2 Universal Gateway≥ 4.5.0.57

Patch & vendor advisories

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430US Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-5430 being actively exploited?

Yes. CVE-2026-5430 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 24 Sept 2026.

How severe is CVE-2026-5430?

CVE-2026-5430 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 0.59% probability of exploitation.

Which products are affected by CVE-2026-5430?

Affected products include Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager, Wso2 Universal Gateway.

How do I fix CVE-2026-5430?

Upgrade affected software to a fixed version, for example Wso2 API Control Plane 4.5.0.58, Wso2 API Manager 4.1.0.257, Wso2 Traffic Manager 4.5.0.56 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-5430 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.