On September 24, 2026, CISA added CVE-2026-5430 to its KEV catalog, with a deadline of the 27th. It affects WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway, and it's rated 10.0.
Before going further, one point I won't smooth over: the two reference sources don't describe the same flaw under this ID. That's unusual, and the right response isn't to pick one, but to handle both.
Two Descriptions for One ID
What CISA says (KEV entry, titled WSO2 Multiple Products Path Traversal Vulnerability):
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.
What NVD says (published August 6, 2026):
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. [...] may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover.
Path traversal leading to file upload on one side, JWT algorithm confusion on the other. Both lead to full compromise, through unrelated mechanisms.
Possible explanations: a WSO2 advisory grouping several defects under one ID, a labelling error on one side or the other, or a chain where the JWT bypass opens access to the upload function. I don't know which is right, and I won't pretend otherwise. The WSO2 security advisory is authoritative.
What's certain: the flaw is being exploited, and it's rated 10.0.
Why Both Readings Are Severe
If it's JWT algorithm confusion
It's a well-known flaw class. A token verifier that accepts the algorithm the token itself declares, instead of enforcing the one it expects, can be fooled:
- with
alg: none, an unsigned token is accepted - with RS256 → HS256 confusion, the attacker signs a token using the server's public key as an HMAC secret — a key everyone knows by definition
On an API gateway, JWTs are the access control for every API it protects. Forging an accepted token means presenting as any user or administrator.
If it's path traversal with upload
Dropping an arbitrary file at a chosen location on a Java gateway typically means dropping a deployable component — hence running code in the gateway, with access to every secret of the APIs it relays.
NVD details the vector: S:C in multi-tenant deployments (10.0), adjusted to 9.8 in single-tenant, where impact stays within a single security authority.
Versions
NVD lists the following bounds — these are WSO2 update levels, not product versions:
| Product | NVD bounds |
|---|---|
| API Manager | 4.1.0.257, 4.2.0.197, 4.3.0.108, 4.4.0.72, 4.5.0.57 |
| API Control Plane | 4.5.0.58, 4.6.0.22 |
| Traffic Manager | 4.5.0.56, 4.6.0.21 |
| Universal Gateway | 4.5.0.57, 4.6.0.21 |
WSO2 ships fixes through its update system (WSO2 Updates). Check the level applied on each node and compare it against the WSO2 advisory.
Detection — Cover Both Hypotheses
For the JWT hypothesis:
- Tokens whose header declares an algorithm different from the configured one (
none,HS256where you useRS256) - Administrator access or privileged API calls with no corresponding portal login
- Tokens accepted for users who didn't authenticate in the period
For the traversal / upload hypothesis:
- Recently created files in deployment directories (
repository/deployment/server/) with no documented deployment - Upload requests containing
../sequences or their encodings - Unexpected child processes of the WSO2 JVM
Mitigation
- Apply the WSO2 update fixing CVE-2026-5430 on every node — Control Plane, Gateway, Traffic Manager. The CISA deadline is September 27.
- Restrict admin consoles (Publisher, Admin, Carbon) to admin networks. Only the gateway should be exposed.
- Enforce the expected signing algorithm in any JWT validation you control downstream of the gateway — the defence that neutralises the first hypothesis regardless of product.
- If compromised: rotate token signing keys, client application secrets and admin credentials, and treat the secrets of relayed APIs as exposed.
Why Continuous Monitoring of API Gateways Matters
An API gateway concentrates authentication for every API it exposes. When a 10.0 CVE is exploited there and the sources can't even agree on what it is, the only reliable footing is knowing exactly which update level runs on each node.
With cveo.tech, inventory your API gateways with exact versions, and get alerted whenever a KEV-listed CVE affects them.