IBM API Connect: Improper authentication vulnerability (CVE-2026-18838)
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an improper authentication vulnerability that allows a remote attacker to obtain sensitive information and modify API configurations.
CVE search metadata
CVE search record: CVE-2026-18838. Severity: critical. CVSS: 9.4. KEV: no. Product: API Connect (12.1.0.0 through 12.1.1.2). Brief: IBM API Connect: Improper authentication vulnerability (CVE-2026-18838). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-98f35000/
Triage facts
Revision 1- Applicability
- API Connect (12.1.0.0 through 12.1.1.2)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 05:56 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a vulnerability due to improper authentication. Identity information provided in requests is not sufficiently verified, allowing remote attackers to impersonate other users. This can lead to the unauthorized disclosure of sensitive information and the modification of API configurations.