Is CVE-2025-8154 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-8154 being exploited in the wild.

How severe is CVE-2025-8154?

Medium severity, with a CVSS score of 5.3, published 11 May 2026.

Which products and versions are affected?

Wso2 API Control Plane 4.5.0, 4.5.0 before update 21; Wso2 API Manager 4.1.0 before update 218, 4.2.0 before update 164, 4.3.0 before update 74, 4.4.0 before update 38, 4.5.0 before update 20, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0; Wso2 Traffic Manager 4.5.0, 4.5.0 before update 19; Wso2 Universal Gateway 4.5.0.

Is there a fix for CVE-2025-8154?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-8154 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-8154?

Check whether you run Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-8154: WSO2 API Manager header injection in Webhook API

CVE-2025-8154 · Severity: medium · CVSS 5.3 · Published 2026-05-11

WSO2 API Manager and related components, which are used to manage and secure digital interfaces (APIs), are vulnerable to a header injection flaw. An attacker can manipulate web requests to inject or overwrite security headers and cookies in the system's responses. This could allow a malicious actor to bypass security controls, hijack user sessions, or interfere with how web browsers cache sensitive data.

Technologies: Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager, Wso2 Universal Gateway. Vendors: Wso2.

Quick answers

Is CVE-2025-8154 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-8154 being exploited in the wild.
How severe is CVE-2025-8154?: Medium severity, with a CVSS score of 5.3, published 11 May 2026.
Which products and versions are affected?: Wso2 API Control Plane 4.5.0, 4.5.0 before update 21; Wso2 API Manager 4.1.0 before update 218, 4.2.0 before update 164, 4.3.0 before update 74, 4.4.0 before update 38, 4.5.0 before update 20, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0; Wso2 Traffic Manager 4.5.0, 4.5.0 before update 19; Wso2 Universal Gateway 4.5.0.
Is there a fix for CVE-2025-8154?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-8154 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-8154?: Check whether you run Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An HTTP header injection vulnerability exists in WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway during Webhook API invocations. The component fails to sufficiently validate or sanitize user-supplied input in HTTP request headers, allowing these values to be reflected or injected into the resulting HTTP responses. A remote, unauthenticated attacker can exploit this to overwrite arbitrary response headers, including security-related headers (like CSP or HSTS) and sensitive cookie values. This can lead to session hijacking, cache poisoning, or the bypass of browser-side security mechanisms. Fixes are available via WSO2 product updates or specific GitHub pull requests for community users.

Affected products

WSO2 API Manager 4.1.0 before update 218, 4.2.0 before update 164, 4.3.0 before update 74, 4.4.0 before update 38, 4.5.0 before update 20
WSO2 API Control Plane 4.5.0 before update 21
WSO2 Traffic Manager 4.5.0 before update 19
WSO2 Universal Gateway 4.5.0 before update 19

Timeline

2026-01-26: advisory: Initial vendor advisory published by WSO2
2026-05-11: disclosed: CVE published to NVD

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.