XXE in Wso2 Api Control Plane
CVE-2026-3415
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplie…
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H.
Affected products
- Wso2 Api Control Plane — versions 4.5.0, 4.6.0
- Wso2 Api Manager — versions 0, 3.2.0, 3.2.1
- Wso2 Carbon Api Gateway — versions 6.7.206, 6.7.210, 9.20.74
- Wso2 Carbon Api Management Implementation — versions 6.7.206, 6.7.210, 9.20.74
- Wso2 Traffic Manager — versions 4.5.0, 4.6.0
- Wso2 Universal Gateway — versions 4.5.0, 4.6.0
Weakness classification (CWE)
References
- ed10eef1-636d-4fbe-9993-6890dfa878f8 (vendor-advisory)
Frequently asked questions
- What is CVE-2026-3415?
- CVE-2026-3415 is a high-severity vulnerability in Wso2 Api Control Plane, classified under Improper Restriction of Recursive Entity References in DTDs (XML Entity Expansion). CVSS score: 8.7/10. Published 2026-08-06.
- How severe is CVE-2026-3415?
- High severity. CVSS v3 base score is 8.7 out of 10.