IBM API Connect: Insecure tenant authorization (CVE-2026-17066)
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a broken access control vulnerability that allows a remote authenticated attacker to access, modify, or delete data across tenants.
CVE search metadata
CVE search record: CVE-2026-17066. Severity: critical. CVSS: 9.1. KEV: no. Product: API Connect (12.1.0.0-12.1.1.2). Brief: IBM API Connect: Insecure tenant authorization (CVE-2026-17066). Brief link: https://feed.craftedsignal.io/briefs/2026-11-07-ibm-api-connect-auth/
Triage facts
Revision 1- Applicability
- API Connect (12.1.0.0-12.1.1.2)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 05:50 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-17066 identifies a critical broken access control vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw allows a remote authenticated attacker to bypass authorization checks within a multi-tenant environment. Successful exploitation grants the attacker the ability to view, modify, or delete sensitive information belonging to other tenants. No patch availability is specified in the NVD notice; administrators should monitor vendor security portals for immediate updates.
Impact
Successful exploitation allows for unauthorized information disclosure, data manipulation, and data destruction across tenant boundaries. This represents a complete compromise of tenant isolation for affected installations.
Recommendation
- Inventory all IBM API Connect deployments to identify instances running versions 12.1.0.0 through 12.1.1.2.
- Restrict administrative and tenant-level access to the API Connect management console until a vendor-supplied patch is applied.
- Audit tenant activity logs for anomalous cross-tenant data access patterns or unauthorized modification attempts.
- Review vendor-provided security bulletins for the release of fixed versions of IBM API Connect.
Immediate actions
Inventory IBM API Connect versions across the environment.
Threat Hunt
Monitor application audit logs for cross-tenant API requests or resource access attempts by authenticated users.
Data: IBM API Connect application audit logs, Tenant ID or resource context fields in API logs
Mitigations
Apply vendor-supplied patches as soon as they become available.
CVE-2026-17066