CVE-2025-7203: WSO2 Management Console credentials exposure in remote logging

CVE-2025-7203 · Severity: medium · CVSS 4.9 · Published 2026-10-19

WSO2's Management Console and product configuration files expose sensitive credentials—including remote log server passwords and encryption keys—in plain text when remote logging is enabled. An administrator with access to the console or someone with file system access to the server can retrieve these secrets, potentially allowing them to manipulate logs or compromise the logging infrastructure.

Technologies: Wso2 API Control Plane, Wso2 API Manager, Wso2 Identity Server, Wso2 Traffic Manager, Wso2 Universal Gateway. Vendors: Wso2.

Quick answers

Is CVE-2025-7203 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-7203 being exploited in the wild.
How severe is CVE-2025-7203?
Medium severity, with a CVSS score of 4.9, published 19 October 2026.
Which products and versions are affected?
Wso2 API Control Plane 4.6.0, 4.5.0; Wso2 API Manager 4.6.0, 4.5.0, 4.4.0, 4.3.0; Wso2 Identity Server 7.1.0, 7.0.0; Wso2 Traffic Manager 4.6.0, 4.5.0; and 1 more.
Is there a fix for CVE-2025-7203?
Yes: fixed in WSO2 API Control Plane 4.6.0 Update 15, 4.5.0 Update 47; WSO2 API Manager 4.6.0 Update 14, 4.5.0 Update 46, 4.4.0 Update 61, 4.3.0 Update 97; WSO2 Identity Server 7.1.0 Update 19, 7.0.0 Update 111; WSO2 Traffic Manager 4.6.0 Update 14, 4.5.0 Update 45; WSO2 Universal Gateway 4.6.0 Update 14, 4.5.0 Update 46. Until then: Apply the provided configuration to deployment.toml with encrypt_secrets = true and hide_secrets = true in the [remote_logging] section. Additionally, rotate the remote log server credentials, truststore password, and keystore password immediately after patching. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-7203 attacked?
It is attacked over the network or with local access, in a hosted service.
Am I affected by CVE-2025-7203?
Check whether you run Wso2 API Control Plane, Wso2 API Manager, Wso2 Identity Server or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: WSO2 API Control Plane 4.6.0 Update 15, 4.5.0 Update 47; WSO2 API Manager 4.6.0 Update 14, 4.5.0 Update 46, 4.4.0 Update 61, 4.3.0 Update 97; WSO2 Identity Server 7.1.0 Update 19, 7.0.0 Update 111; WSO2 Traffic Manager 4.6.0 Update 14, 4.5.0 Update 45; WSO2 Universal Gateway 4.6.0 Update 14, 4.5.0 Update 46

Apply the provided configuration to deployment.toml with encrypt_secrets = true and hide_secrets = true in the [remote_logging] section. Additionally, rotate the remote log server credentials, truststore password, and keystore password immediately after patching.

Technical details

The Management Console and product configuration files fail to encrypt or obscure remote logging credentials, truststore passwords, and keystore passwords, storing them in plain text. Exploitation requires either a valid administrative user account for the Management Console (network attack vector) or direct filesystem access to product files (local attack vector). An attacker gaining these credentials can access and manipulate the remote log server, compromising log integrity.

Affected products

  • WSO2 API Control Plane 4.6.0, 4.5.0
  • WSO2 API Manager 4.6.0, 4.5.0, 4.4.0, 4.3.0
  • WSO2 Identity Server 7.1.0, 7.0.0
  • WSO2 Traffic Manager 4.6.0, 4.5.0
  • WSO2 Universal Gateway 4.6.0, 4.5.0

Timeline

  • 2026-05-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.