IBM API Connect: Authentication bypass via improper signature verification (CVE-2026-17301)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to an authentication bypass vulnerability. This flaw arises from the improper verification of cryptographic signatures, which an unauthenticated attacker could potentially exploit to bypass security controls and gain unauthorized access to the application.

Impact

Successful exploitation allows an unauthenticated attacker to bypass authentication, potentially resulting in unauthorized access to API management functions and sensitive data. The vulnerability is rated with a CVSS v3.1 base score of 9.8.

Recommendation

• Inventory all instances of IBM API Connect within the environment to identify systems running the vulnerable version ranges (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2).
• Review IBM security advisories for the release of security patches addressing CVE-2026-17301 and apply the appropriate update immediately upon availability.
• Monitor API gateway access logs for anomalous authentication patterns or requests targeting sensitive endpoints originating from unauthorized sources.