Executive brief
WSO2 API Manager and related components, which are used to manage and secure digital interfaces (APIs), are vulnerable to a header injection flaw. An attacker can manipulate web requests to inject or overwrite security headers and cookies in the system's responses. This could allow a malicious actor to bypass security controls, hijack user sessions, or interfere with how web browsers cache sensitive data.
Technical details
An HTTP header injection vulnerability exists in WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway during Webhook API invocations. The component fails to sufficiently validate or sanitize user-supplied input in HTTP request headers, allowing these values to be reflected or injected into the resulting HTTP responses. A remote, unauthenticated attacker can exploit this to overwrite arbitrary response headers, including security-related headers (like CSP or HSTS) and sensitive cookie values. This can lead to session hijacking, cache poisoning, or the bypass of browser-side security mechanisms. Fixes are available via WSO2 product updates or specific GitHub pull requests for community users.
Affected products
- WSO2 API Manager 4.1.0 before update 218, 4.2.0 before update 164, 4.3.0 before update 74, 4.4.0 before update 38, 4.5.0 before update 20
- WSO2 API Control Plane 4.5.0 before update 21
- WSO2 Traffic Manager 4.5.0 before update 19
- WSO2 Universal Gateway 4.5.0 before update 19
Timeline
- 2026-01-26: advisory: Initial vendor advisory published by WSO2
- 2026-05-11: disclosed: CVE published to NVD