erroneo.us
Search all guides⌘K

Digest · Sunday

Security digest: May 3, 2026

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Act now: WSO2 API Manager CVE-2026-5430: Exploited JWT Auth Bypass. Teams running WSO2 API Manager 4.1.0-4.6.0, or API Control Plane, Traffic Manager or Universal Gateway 4.5.0/4.6.0, without the April 2026 update levels or the public fix PRs.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-5430

WSO2 API Manager CVE-2026-5430: Exploited JWT Auth Bypass

Any self-managed WSO2 API Manager 4.1-4.6, API Control Plane, Traffic Manager or Universal Gateway below the fixed update level should be patched now and checked for forged-token use; attackers have been sending forged admin JWTs since mid-September.

Must act: Teams running WSO2 API Manager 4.1.0-4.6.0, or API Control Plane, Traffic Manager or Universal Gateway 4.5.0/4.6.0, without the April 2026 update levels or the public fix PRs.

Can relax: Deployments already at or above the update levels in WSO2-2026-5328, and WSO2 products not listed in the advisory, such as Identity Server.

  1. List every WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway node and run ./wso2update_linux current-state from <product-home>/bin.
  2. Update each node to the level in WSO2-2026-5328 or higher, or build with the public fix PRs if you run community builds; restart every node.
  3. Restrict the publisher, admin and devportal consoles and management APIs to trusted networks.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.