CVE-2026-0637

Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products

State: Published
Severity: 4.4 Medium
Published: Aug 6, 2026
Updated: Aug 6, 2026
Reserved: Jan 6, 2026

Description

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values.

A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information, such as user credentials or other confidential data, that was inadvertently logged due to misconfiguration, potentially leading to unauthorized access.

Scores

CVSS	Score	Vector	Source
3.1	4.4 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	WSO2

Weaknesses

CWE-532 Insertion of Sensitive Information into Log Files

Affected Products

Product	Versions
WSO2 API ManagerWSO2	before 3.1.0Unknown 3.1.0 to before 3.1.0.357Affected 3.2.0 to before 3.2.0.465Affected 3.2.1 to before 3.2.1.84Affected 4.1.0 to before 4.1.0.249Affected 4.2.0 to before 4.2.0.189Affected 4.3.0 to before 4.3.0.100Affected 4.4.0 to before 4.4.0.64Affected 4.5.0 to before 4.5.0.49Affected 4.6.0 to before 4.6.0.13Affected
WSO2 Traffic ManagerWSO2	before 4.5.0Unknown 4.5.0 to before 4.5.0.48Affected 4.6.0 to before 4.6.0.13Affected
WSO2 API Control PlaneWSO2	before 4.5.0Unknown 4.5.0 to before 4.5.0.50Affected 4.6.0 to before 4.6.0.14Affected
WSO2 Universal GatewayWSO2	before 4.5.0Unknown 4.5.0 to before 4.5.0.49Affected 4.6.0 to before 4.6.0.13Affected
WSO2 Identity ServerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.386Affected 5.11.0 to before 5.11.0.433Affected 6.0.0 to before 6.0.0.260Affected 6.1.0 to before 6.1.0.261Affected 7.0.0 to before 7.0.0.139Affected 7.1.0 to before 7.1.0.47Affected 7.2.0 to before 7.2.0.8Affected
WSO2 Identity Server as Key ManagerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.377Affected
WSO2 Open Banking IAMWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.426Affected
WSO2 Open Banking AMWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.406Affected
WSO2 Carbon Event Publisher CoreWSO2	5.2.24 to before 5.2.24.11Affected 5.2.26 to before 5.2.26.24Affected 5.2.27 to before 5.2.27.7Affected 5.2.41 to before 5.2.41.8Affected 5.2.45 to before 5.2.45.2Affected 5.2.50 to before 5.2.50.3Affected 5.2.57 to before 5.2.57.12Affected 5.2.58 to before 5.2.58.3Affected 5.2.61 to before 5.2.61.4Affected 5.2.64 to before 5.2.64.1Affected 5.3.5 to before 5.3.5.10Affected 5.3.11 to before 5.3.11.7Affected 5.3.15 to before 5.3.15.6Affected 5.3.20 to before 5.3.20.3Affected 5.3.27 to before 5.3.27.1Affected x and laterNot affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.