CVE-2026-2613
Received Received - Intake

Admin REST API Blind SQL Injection Vulnerability

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: WSO2 LLC

Description
The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-2613

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a high-severity SQL injection vulnerability in WSO2 products. It occurs in the Admin REST API where user input is not properly sanitized before being used in SQL queries. An authenticated administrator can manipulate SQL query structures through blind SQL injection, potentially exposing sensitive data or disrupting database services.

Detection Guidance

To detect this vulnerability, monitor SQL query logs for unusual patterns or errors in WSO2 Admin REST API requests. Check for blind SQL injection attempts by analyzing HTTP requests with suspicious payloads like time delays or error-based queries. Use tools like SQLMap to test for SQL injection in the Admin REST API endpoints.

Impact Analysis

An attacker with admin access could extract sensitive database information or cause database unavailability. This may lead to data breaches, unauthorized access to confidential data, or service disruptions affecting business operations.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply the patches provided by WSO2 via the GitHub pull request or upgrade to unaffected versions (4.6.1 or later for API Manager, Traffic Manager, and Universal Gateway). Restrict access to the Admin REST API to trusted administrators only. Monitor database logs for unusual activity and implement WAF rules to block SQL injection attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2613. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...