CVE-2025-8154: wso2 api_control_plane Injection
Vulnerability summary
CVE-2025-8154 is a high (CVSS 7.5) Injection vulnerability in wso2 api_control_plane. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 7.6% of scored vulnerabilities.
Timeline
- 11-05-2026PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
0.00 pp
From 0.19% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Wso210 products
- api_control_plane≥ 4.5.0, < 4.5.0.21
- api_manager≥ 4.1.0, < 4.1.0.218 | ≥ 4.2.0, < 4.2.0.164 | ≥ 4.3.0, < 4.3.0.74 | ≥ 4.4.0, < 4.4.0.38 | ≥ 4.5.0, < 4.5.0.20
- traffic_manager≥ 4.5.0, < 4.5.0.19
- universal_gateway≥ 4.5.0, < 4.5.0.19
- wso2 api control plane≥ 4.5.0, < 4.5.0.21
1 vendor · 10 products