IBM API Connect: Broken Object-Level Authorization (CVE-2026-17112)
IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a broken object-level authorization (BOLA) vulnerability allowing authenticated attackers to access sensitive data of other tenants.
CVE search metadata
CVE search record: CVE-2026-17112. Severity: high. CVSS: 7.7. KEV: no. Product: API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2). Brief: IBM API Connect: Broken Object-Level Authorization (CVE-2026-17112). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-611f9275/
Triage facts
Revision 1- Applicability
- API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 06:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a broken object-level authorization (BOLA) vulnerability. An authenticated attacker can exploit this flaw to bypass tenant isolation and access sensitive data belonging to other tenants within the multi-tenant API environment.
Impact
Successful exploitation allows a remote authenticated attacker to read sensitive information belonging to other tenants, leading to unauthorized data exposure.
Recommendation
Identify and inventory instances of IBM API Connect within the environment. Review vendor security bulletins for available patches for the affected versions (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2) and apply updates immediately.
Immediate actions
Identify and patch vulnerable IBM API Connect instances
Threat Hunt
Monitor API access logs for anomalous cross-tenant resource requests
Data: API gateway access logs
Mitigations
Apply vendor-supplied patches for affected versions
CVE-2026-17112