CVE-2026-18800: Medium severity vulnerability
When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property.
A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove irrelevant properties from the Event Publisher output adapter configuration so they are not logged.
Event Publisher output adapter configured properties = only properties relevant to the adapter's function
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments are exposed when an Event Publisher output adapter is configured with properties that are irrelevant to its function and those properties contain credentials or other confidential values. Exploitation also requires access to the wso2carbon log files.
What does an attacker need to do to obtain sensitive information?
The attacker needs access to the wso2carbon logs and must locate values logged from irrelevant Event Publisher output-adapter properties. The impact depends on whether the misconfigured properties contained credentials or other critical secrets.
What can be done if patching is not immediately possible?
Review Event Publisher output-adapter configurations and remove irrelevant properties, especially any that contain credentials or confidential information. Restrict access to wso2carbon log files to prevent unauthorized users from reading previously logged values.
How can teams determine whether they may already be affected?
Inspect Event Publisher output-adapter configurations for properties unrelated to the adapter's function, then review wso2carbon logs for sensitive values that may have been recorded. If credentials or secrets appear in the logs, treat them as exposed.