CVE-2026-0637

🗓️ 06 Aug 2026 08:16:29Reported by [email protected]Type

nvd🔗 web.nvd.nist.gov👁 10 Views

CVE-2026-0637: Misconfigured Event Publisher logs expose credentials via wso2carbon logs.

Reporter	Title	Published	Views	Family All 5
ATTACKERKB	CVE-2026-0637	6 Aug 202607:33	–	attackerkb
CVE	CVE-2026-0637	6 Aug 202607:33	–	cve
Cvelist	CVE-2026-0637 Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products	6 Aug 202607:33	–	cvelist
EUVD	EUVD-2026-53820	6 Aug 202607:33	–	euvd
Vulnrichment	CVE-2026-0637 Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products	6 Aug 202607:33	–	vulnrichment

NVD

Node

OR

wso2 api_control_planeRange4.5.0–4.5.0.50

wso2 api_control_planeRange4.6.0–4.6.0.14

wso2 api_managerRange3.1.0–3.1.0.357

wso2 api_managerRange3.2.0–3.2.0.465

wso2 api_managerRange3.2.1–3.2.1.84

wso2 api_managerRange4.1.0–4.1.0.249

wso2 api_managerRange4.2.0–4.2.0.189

wso2 api_managerRange4.3.0–4.3.0.100

wso2 api_managerRange4.4.0–4.4.0.64

wso2 api_managerRange4.5.0–4.5.0.49

wso2 api_managerRange4.6.0–4.6.0.13

wso2 identity_serverRange5.10.0–5.10.0.386

wso2 identity_serverRange5.11.0–5.11.0.433

wso2 identity_serverRange6.0.0–6.0.0.260

wso2 identity_serverRange6.1.0–6.1.0.261

wso2 identity_server_as_key_managerRange5.10.0–5.10.0.377

wso2 open_banking_amRange2.0.0–2.0.0.406

wso2 open_banking_iamRange2.0.0–2.0.0.426

wso2 traffic_managerRange4.5.0–4.5.0.48

wso2 traffic_managerRange4.6.0–4.6.0.13

wso2 universal_gatewayRange4.5.0–4.5.0.49

wso2 universal_gatewayRange4.6.0–4.6.0.13

Source	Link
security	www.security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/

12 Aug 2026 19:29Current

CVSS 3.14.4

EPSS0.00113

event publisher output adapter misconfiguration log leakage credentials sensitive data