IBM API Connect: Information disclosure via external references (CVE-2026-17285)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability (CVE-2026-17285) that permits an authenticated remote attacker to obtain sensitive information. The flaw stems from improper validation of external references when the application processes schemas, allowing the server to fetch content from unauthorized external resources.

Impact

Successful exploitation allows a remote authenticated attacker to access and retrieve sensitive information from external resources that the server should not have permission to reach.

Recommendation

• Inventory instances of IBM API Connect within your environment to identify versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2.
• Review vendor security bulletins for the release of patches addressing CVE-2026-17285 and schedule upgrades immediately upon availability.
• Review API gateway configuration logs for abnormal outbound requests originating from the API Connect server towards internal or external unauthorized endpoints.