Executive Summary: Zero-Day Path Traversal in Enterprise API Gateways

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-5430 to its Known Exploited Vulnerabilities (KEV) Catalog, following confirmation of active in-the-wild exploitation targeting WSO2 API Manager and its companion API Control Plane and Universal Gateway microservices. WSO2 API Manager is one of the premier enterprise middleware backbones globally, responsible for routing, throttling, authenticating, and monetizing billions of API calls daily across telecommunications, banking, healthcare, and government systems.

Rated at a near-maximum CVSS v3.1 base score of 9.8 Critical, the vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). An unauthenticated remote adversary with network access to the API Gateway can issue crafted HTTP requests that escape the web root boundary, allowing arbitrary file retrieval from the host filesystem. This enables attackers to harvest plaintext administrative credentials, private Java KeyStores (JKS), database connection strings, and OAuth client secrets without requiring valid user authentication.

Root Cause Anatomy: Filter Bypass in Carbon URI Normalization

WSO2 products are built on top of the modular Carbon runtime framework. Incoming HTTP requests are routed through a series of Java servlet filters before reaching specific service handlers (such as the Publisher, DevPortal, or Key Manager endpoints).

The vulnerability exists in how the Carbon web servlet container handles non-standard URI encoding schemes and path normalization before passing requested resource paths to internal static asset dispatchers: 

// Decompiled representation of vulnerable resource locator logic in WSO2 Carbon
public InputStream getStaticResource(String requestUri) throws IOException {
    // Insufficient path sanitization: resolves URL-encoded traversal patterns incorrectly
    String decodedUri = URLDecoder.decode(requestUri, StandardCharsets.UTF_8.name());
    
    // Naive check only searched for raw "../" sequences
    if (decodedUri.contains("../")) {
        throw new SecurityException("Illegal directory traversal sequence detected");
    }
    
    // Critical CWE-22: Double URL-encoding or null-byte insertion bypasses the check
    File targetFile = new File(this.repositoryRoot, decodedUri);
    return new FileInputStream(targetFile);
}

When threat actors transmitted double-encoded traversal sequences (such as %252e%252e%252f or overlong UTF-8 variants), the initial filtering logic failed to recognize the directory traversal pattern. When downstream file loaders subsequently decoded the string a second time, the resulting path successfully navigated above the webroot into sensitive OS directories like /repository/conf/ and /etc/.

Exploitation Telemetry & The Exfiltration Sequence

Threat actors weaponizing CVE-2026-5430 follow an automated multi-step reconnaissance and credential extraction pipeline:

Step Target Resource Strategic Value to Attacker
1. Configuration Recon /repository/conf/deployment.toml Extracts primary master database connection credentials, carbon admin credentials, and LDAP/AD bind configurations
2. Keystore Theft /repository/resources/security/wso2carbon.jks Acquires the primary Carbon private key, enabling the forgery of JWT tokens accepted by downstream API microservices
3. Tenant Secret Harvesting /repository/conf/identity/identity.xml Extracts OAuth2 token issuer keys, SAML SSO signing certificates, and API key hashing salts
4. Total API Hijack Downstream API Endpoints Using forged JWTs minted with stolen keys, attackers query protected internal banking and customer APIs with super-admin permissions

Attack Mechanics & Raw Exploit Request

The following HTTP request demonstrates an active exploit sequence attempting to siphon the core deployment.toml configuration file from an unpatched gateway: 

GET /carbon/admin/layout/..%252f..%252f..%252frepository/conf/deployment.toml HTTP/1.1
Host: api-gateway.corp.enterprise.com:9443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept: */*
Connection: close

The server responds with an HTTP 200 containing the raw TOML configuration file, exposing database passwords, encryption salts, and private API definitions directly to the unauthorized client.

Incident Response & Remediation Playbook

  1. Apply Official WSO2 Cumulative Updates: 
    # Execute WSO2 Update Manager (WUM) in the product root directory
./bin/wum update wso2am-4.2.0

# Alternatively, apply cumulative update tool
./bin/wso2update_linux run
  2. Rotate All Keystores and Gateway Credentials Immediately: Because passive exploitation leaves zero traces of file modification, any system exposed to the Internet must treat existing database passwords, administrative secrets, and Java keystore private keys as fully compromised. Generate fresh JKS files and deploy new signing certificates.
  3. Isolate Management Ports from Public Ingress: Ensure TCP port 9443 (Carbon management console) is strictly bound to internal management subnets and unreachable from public WAN interfaces. Public gateways should expose only port 8243 / 8280 for runtime API traffic.
  4. Deploy WAF Inspection Rules: Configure perimeter Web Application Firewalls (Cloudflare, AWS WAF, ModSecurity) to block all URI paths matching double-encoded dot-dot-slash patterns: 
    SecRule REQUEST_URI "@rx (?i)(%252e|%2e|..)(%252f|%2f|/)"     "id:1000089,phase:1,deny,status:403,log,msg:'WSO2 CVE-2026-5430 Directory Traversal Attempt'"