CVE-2026-18800
Received Received - Intake

Information Disclosure in WSO2 Carbon via Misconfigured Logs

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: WSO2 LLC

Description
When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-18800

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability occurs when an Event Publisher output adapter in WSO2 products is misconfigured with irrelevant properties. These properties get logged, potentially exposing sensitive data like user credentials or confidential information in the wso2carbon log files. A malicious actor with log access could exploit this to retrieve sensitive information.

Detection Guidance

Check WSO2 product logs for Event Publisher warnings containing sensitive data. Search for 'wso2carbon' logs for entries with irrelevant properties or credentials. Use commands like 'grep -r "wso2carbon" /path/to/logs' or 'find /path/to/logs -type f -exec grep -l "Event Publisher" {} \;' to locate relevant log files.

Impact Analysis

If you use affected WSO2 products, this vulnerability could lead to unauthorized access if sensitive data like credentials are logged. Attackers with log file access may retrieve these credentials or other secrets, potentially compromising your system or data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing personal or sensitive data through insecure logging. Unauthorized access to credentials or confidential information may result in violations of data protection requirements.

Mitigation Strategies

Apply public fixes or update to the latest unaffected versions of affected WSO2 products. For community users, apply the GitHub pull request fix. Support subscribers should update to specified versions. Review and remove irrelevant properties in Event Publisher configurations to prevent logging sensitive data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18800. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...