CVE-2026-4052
Critical
Description
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.
SeverityCritical
CVSS9.8
Exploit probability—
ProductWSO2 API Manager
PublishedNov 3, 2026
First seenNov 4, 2026
Weakness typeCWE-862Missing authorization
How to fix
Update
- WSO2 WSO2 Identity Server Key Manager Connector (apim-km-wso2is)1.8.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WSO2 WSO2 API Manager | 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0 | — |
| WSO2 WSO2 API Control Plane | 4.5.0, 4.6.0 | — |
| WSO2 WSO2 Identity Server Key Manager Connector (apim-km-wso2is) | v < 1.8.8 | 1.8.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.