vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-8154

HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation

HIGH
7.5
CVSS Score
Published: May 11, 2026 at 09:30 AM UTC
Updated: October 14, 2026 at 01:10 PM UTC
6 products affected across 1 vendorAPI ManagerAPI Control PlaneTraffic Manager

Using WSO2 API Manager by WSO2?

Get instant alerts when new vulnerabilities affect WSO2 API Manager - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

API Control Plane· WSO2
95%
All versions4.5.0 ≤ v < 4.5.0.214.5.0
Affected range stops below 4.5.0.21, so it looks safe — our inference, not a vendor statement
API Manager· WSO2
95%
All versions4.1.0 ≤ v < 4.1.0.2184.2.0 ≤ v < 4.2.0.1644.3.0 ≤ v < 4.3.0.744.4.0 ≤ v < 4.4.0.384.5.0 ≤ v < 4.5.0.204.1.04.2.04.3.04.4.04.5.0
Affected range stops below 4.1.0.218, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.2.0.164, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.3.0.74, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.4.0.38, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.5.0.20, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 4.1.0 (unknown)
Traffic Manager· WSO2
95%
All versions4.5.0 ≤ v < 4.5.0.194.5.0
Affected range stops below 4.5.0.19, so it looks safe — our inference, not a vendor statement
Universal Gateway· WSO2
95%
All versions4.5.0 ≤ v < 4.5.0.194.5.0
Affected range stops below 4.5.0.19, so it looks safe — our inference, not a vendor statement
Carbon API Gateway· WSO2
90%
9.20.74 ≤ v < 9.20.74.3749.28.116 ≤ v < 9.28.116.3639.29.120 ≤ v < 9.29.120.1819.30.67 ≤ v < 9.30.67.1049.31.86 ≤ v < 9.31.86.649.20.749.28.1169.29.1209.30.679.31.86
Affected range stops below 9.20.74.374, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.28.116.363, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.29.120.181, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.30.67.104, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.31.86.64, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 9.32.2 (unaffected)
Carbon Apimgt Impl· WSO2maven
90%
9.20.74 ≤ v < 9.20.74.3749.28.116 ≤ v < 9.28.116.3639.29.120 ≤ v < 9.29.120.1819.30.67 ≤ v < 9.30.67.1049.31.86 ≤ v < 9.31.86.649.20.749.28.1169.29.1209.30.679.31.86
Affected range stops below 9.20.74.374, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.28.116.363, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.29.120.181, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.30.67.104, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.31.86.64, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 9.32.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (1)

Vendor Advisory
Source: cverecord
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGH[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE
Vector?

Quick Info

StatusANALYZED
CWE
CWE-74

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card