IBM API Connect: Improper authorization information disclosure (CVE-2026-17334)
IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to an improper authorization flaw that allows remote authenticated attackers to access sensitive information via user-controlled keys.
CVE search metadata
CVE search record: CVE-2026-17334. Severity: high. CVSS: 8.5. KEV: no. Product: API Connect (12.1.0.0 through 12.1.1.2). Brief: IBM API Connect: Improper authorization information disclosure (CVE-2026-17334). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-afa064d3/
Triage facts
Revision 1- Applicability
- API Connect (12.1.0.0 through 12.1.1.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 04:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability involving improper authorization when handling user-controlled keys. This flaw allows a remote authenticated attacker to bypass intended authorization controls and retrieve sensitive information. No specific exploit code or active exploitation instances were detailed in the disclosure.
Impact
Successful exploitation of this vulnerability results in the unauthorized disclosure of sensitive data managed by the API Connect instance. The vulnerability carries a CVSS v3.1 base score of 8.5.
Recommendation
- Inventory all deployed instances of IBM API Connect to identify versions 12.1.0.0 through 12.1.1.2.
- Monitor IBM support channels for the release of an official security patch addressing CVE-2026-17334.
- Review API access logs for anomalous request patterns originating from authenticated user accounts, specifically focusing on unauthorized access to keys or administrative endpoints.
Immediate actions
Identify and inventory all IBM API Connect instances within the environment.
Threat Hunt
Identify authenticated users accessing unusual key-related endpoints or data resources.
Data: API access logs, Authentication logs
Mitigations
Upgrade IBM API Connect to the next available patched version upon vendor release.
CVE-2026-17334