# CVE-2026-2613: WSO2 API Manager Admin REST API SQL injection

Source: https://junglewise.ai/threats/cve-2026-2613-the-admin-rest-api-accepts-user-supplied-input-without-adequately  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-2613 · Severity: high · CVSS 8.7 · Published 2026-11-02

WSO2 API Manager is a platform for creating, managing, and publishing APIs. The Admin REST API contains a SQL injection flaw that allows authenticated administrators to manipulate database queries and extract sensitive information or disrupt the database. An attacker with admin credentials can exploit this to access confidential data or cause service outages.

Technologies: [Wso2 API Control Plane](https://junglewise.ai/threats/technologies/api-control-plane), [Wso2 API Manager](https://junglewise.ai/threats/technologies/api-manager), [Wso2 Traffic Manager](https://junglewise.ai/threats/technologies/traffic-manager), [Wso2 Universal Gateway](https://junglewise.ai/threats/technologies/universal-gateway). Vendors: [Wso2](https://junglewise.ai/threats/vendors/wso2).

## Quick answers

**Is CVE-2026-2613 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2613 being exploited in the wild.

**How severe is CVE-2026-2613?** High severity, with a CVSS score of 8.7, published 2 November 2026.

**Which products and versions are affected?** Wso2 API Control Plane 4.5.0, 4.6.0; Wso2 API Manager 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0; Wso2 Traffic Manager 4.5.0, 4.6.0; Wso2 Universal Gateway 4.5.0, 4.6.0.

**Is there a fix for CVE-2026-2613?** Yes: fixed in API Manager 4.0.0 Update 387, 4.1.0 Update 251, 4.2.0 Update 191, 4.3.0 Update 102, 4.4.0 Update 66, 4.5.0 Update 51, 4.6.0 Update 15; API Control Plane 4.5.0 Update 52, 4.6.0 Update 16; Traffic Manager 4.5.0 Update 50, 4.6.0 Update 15; Universal Gateway 4.5.0 Update 51, 4.6.0 Update 15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2613 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-2613?** Check whether you run Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in API Manager 4.0.0 Update 387, 4.1.0 Update 251, 4.2.0 Update 191, 4.3.0 Update 102, 4.4.0 Update 66, 4.5.0 Update 51, 4.6.0 Update 15; API Control Plane 4.5.0 Update 52, 4.6.0 Update 16; Traffic Manager 4.5.0 Update 50, 4.6.0 Update 15; Universal Gateway 4.5.0 Update 51, 4.6.0 Update 15

## Technical details

The Admin REST API fails to properly sanitize user-supplied input before incorporating it into SQL statement structure, allowing blind SQL injection. The vulnerability requires authentication as an administrator and network access to the API. An authenticated attacker can infer database information and potentially impact database availability.

## Affected products

- WSO2 API Manager 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0
- WSO2 API Control Plane 4.5.0, 4.6.0
- WSO2 Traffic Manager 4.5.0, 4.6.0
- WSO2 Universal Gateway 4.5.0, 4.6.0

## Timeline

- 2026-05-03: disclosed

## References

- [https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/)

## Related threats

- [WSO2 Identity Server privilege escalation via shared database](https://junglewise.ai/threats/cve-2026-4052-this-issue-only-impacts-deployments-where-wso2-identity-server-is)
- [WSO2 API Manager SVG upload stored XSS in Publisher portal](https://junglewise.ai/threats/cve-2025-12544-the-publisher-portal-fails-to-enforce-proper-validation-on)
- [WSO2 products sensitive information disclosure in Event Publisher logs](https://junglewise.ai/threats/cve-2026-18800-when-an-event-publisher-output-adapter-is-configured-with)
- [WSO2 System REST APIs access control bypass](https://junglewise.ai/threats/cve-2025-11969-the-system-rest-apis-do-not-correctly-enforce-access-control)
- [WSO2 username enumeration in external user store authentication](https://junglewise.ai/threats/cve-2024-7478-when-a-wso2-product-is-configured-to-use-an-external-user-store)