IBM API Connect: Unauthorized administrative access due to case sensitivity handling (CVE-2026-17409)
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where improper handling of case sensitivity leads to inconsistent application of access controls.
CVE search metadata
CVE search record: CVE-2026-17409. Severity: critical. CVSS: 9.4. KEV: no. Product: API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2). Brief: IBM API Connect: Unauthorized administrative access due to case sensitivity handling (CVE-2026-17409). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-cve-2026-17409/
Triage facts
Revision 1- Applicability
- API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 05:56 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a vulnerability (CVE-2026-17409) that may allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information. The issue arises from improper handling of case sensitivity, which causes access controls to be applied inconsistently to variations of a request.