IBM API Connect: Unauthorized tenant access via LDAP injection (CVE-2026-17392)
IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain an LDAP injection vulnerability that allows authenticated attackers to perform cross-tenant unauthorized administrative access.
CVE search metadata
CVE search record: CVE-2026-17392. Severity: critical. CVSS: 9.9. KEV: no. Product: API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2). Brief: IBM API Connect: Unauthorized tenant access via LDAP injection (CVE-2026-17392). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ldap-injection/
Triage facts
Revision 1- Applicability
- API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 05:55 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
IBM API Connect contains an LDAP injection vulnerability due to improper neutralization of user-supplied input in directory queries. An authenticated remote attacker can exploit this flaw to manipulate the logic of LDAP queries, potentially leading to unauthorized administrative access to other tenants within the environment. As of the current disclosure, IBM has released advisory information; administrators should verify their current version against the affected ranges.
Impact
The vulnerability allows an authenticated attacker to bypass standard authorization controls, resulting in unauthorized administrative access to tenants other than their own. The vulnerability is rated with a CVSS v3.1 base score of 9.9.
Recommendation
- Identify all instances of IBM API Connect within the environment and verify current versioning.
- Review IBM security bulletins for the availability of patches addressing CVE-2026-17392.
- Monitor API Connect access logs for anomalous administrative behavior or high-frequency directory queries originating from standard user accounts.
Immediate actions
Inventory IBM API Connect installations and verify if versions 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2 are in use.
Threat Hunt
Identify authenticated users executing unexpected administrative API calls or cross-tenant query patterns.
Data: API Connect audit logs, LDAP query logs
Mitigations
Apply security patches or upgrade to a version outside the affected ranges as soon as released by IBM.
CVE-2026-17392