IBM API Connect: Authorization bypass (CVE-2026-17049)

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a critical authorization bypass vulnerability (CVE-2026-17049). An attacker with existing authenticated access can manipulate user-controlled keys to bypass authorization checks, enabling unauthorized information disclosure and modification of arbitrary documents within the environment.

Impact

Successful exploitation allows a remote authenticated attacker to read sensitive data and modify arbitrary documents, potentially leading to full compromise of data integrity and confidentiality within the API Connect environment.

Recommendation

• Inventory all instances of IBM API Connect within the environment to identify versions 12.1.0.0 through 12.1.1.2.
• Apply the latest vendor security patches to remediate CVE-2026-17049 immediately.
• Review access logs and API audit trails for suspicious patterns of unauthorized document modification or unexpected data retrieval requests associated with authenticated user accounts.