Cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aibmapi_connect12.1.1.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 06:08:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgIBM API Connect: Insecure direct object reference (CVE-2026-17320)https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-idor-88459b41/Sat, 07 Nov 2026 06:08:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-idor-88459b41/IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw, allowing a remote authenticated attacker to access sensitive information.IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an Insecure Direct Object Reference (IDOR) vulnerability identified as CVE-2026-17320. This vulnerability allows a remote authenticated attacker to access sensitive information by manipulating direct object references within the application. No patch availability or remediation steps are explicitly detailed in the current NVD advisory.

Impact

Successful exploitation allows a remote authenticated attacker to bypass authorization controls and retrieve sensitive information, leading to unauthorized data exposure.

Recommendation

  • Inventory all instances of IBM API Connect within the environment to identify systems running versions 12.1.0.0 through 12.1.1.2.
  • Monitor vendor security portals for the release of security patches or configuration guidance to mitigate CVE-2026-17320.
  • Audit API access logs for anomalous patterns where authenticated users request resources outside their typical scope or ID ranges.
]]>highadvisoryidorvulnerabilityapi-securityIBM API Connect: Server-side request forgery (CVE-2026-17188)https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-40d36208/Sat, 07 Nov 2026 06:02:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-40d36208/IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF) during the import of service definitions, allowing an authenticated attacker to access unauthorized internal resources.IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker can exploit this flaw by providing malicious references to external resources during the service definition import process. Successful exploitation allows the server to make requests to internal or restricted network resources, potentially leading to information disclosure.

Impact

An authenticated attacker can abuse the API import feature to perform reconnaissance on internal network infrastructure or access unauthorized services that are otherwise unreachable from the internet.

Recommendation

  • Inventory all instances of IBM API Connect and identify those running versions 12.1.0.0 through 12.1.1.2.
  • Monitor API gateway logs for unusual outbound requests originating from the API Connect server, particularly those targeting internal IP ranges or sensitive internal management interfaces.
  • Apply the latest vendor security patches provided by IBM for API Connect to remediate CVE-2026-17188.
]]>highadvisoryIBM API Connect: Path traversal vulnerability (CVE-2026-17339)https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-traversal/Sat, 07 Nov 2026 05:54:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-traversal/IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that permits a remote authenticated attacker to perform unauthorized access or deletion of resources belonging to other tenants.IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a path traversal vulnerability. This flaw allows a remote, authenticated attacker to manipulate API requests to access or delete resources belonging to other tenants within the multi-tenant environment.

Impact

Successful exploitation allows for unauthorized cross-tenant data access and the potential destruction of sensitive API resources, leading to a loss of data confidentiality and integrity.

Recommendation

  • Inventory all deployments of IBM API Connect to identify instances running versions 12.1.0.0 through 12.1.1.2.
  • Monitor vendor channels for the release of security patches or configuration workarounds for CVE-2026-17339.
  • Implement strict request validation and object-level authorization checks at the API gateway layer for all tenant-specific endpoints until updates are applied.
]]>criticaladvisorypath-traversalweb-applicationapi-securityIBM API Connect: Insecure tenant authorization (CVE-2026-17066)https://feed.craftedsignal.io/briefs/2026-11-07-ibm-api-connect-auth/Sat, 07 Nov 2026 05:50:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-07-ibm-api-connect-auth/IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a broken access control vulnerability that allows a remote authenticated attacker to access, modify, or delete data across tenants.CVE-2026-17066 identifies a critical broken access control vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw allows a remote authenticated attacker to bypass authorization checks within a multi-tenant environment. Successful exploitation grants the attacker the ability to view, modify, or delete sensitive information belonging to other tenants. No patch availability is specified in the NVD notice; administrators should monitor vendor security portals for immediate updates.

Impact

Successful exploitation allows for unauthorized information disclosure, data manipulation, and data destruction across tenant boundaries. This represents a complete compromise of tenant isolation for affected installations.

Recommendation

  • Inventory all IBM API Connect deployments to identify instances running versions 12.1.0.0 through 12.1.1.2.
  • Restrict administrative and tenant-level access to the API Connect management console until a vendor-supplied patch is applied.
  • Audit tenant activity logs for anomalous cross-tenant data access patterns or unauthorized modification attempts.
  • Review vendor-provided security bulletins for the release of fixed versions of IBM API Connect.
]]>criticaladvisoryIBM API Connect: Authorization bypass (CVE-2026-17049)https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-d844761e/Sat, 07 Nov 2026 05:49:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-d844761e/IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to an authorization bypass allowing remote authenticated attackers to access sensitive information and modify arbitrary documents.IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a critical authorization bypass vulnerability (CVE-2026-17049). An attacker with existing authenticated access can manipulate user-controlled keys to bypass authorization checks, enabling unauthorized information disclosure and modification of arbitrary documents within the environment.

Impact

Successful exploitation allows a remote authenticated attacker to read sensitive data and modify arbitrary documents, potentially leading to full compromise of data integrity and confidentiality within the API Connect environment.

Recommendation

  • Inventory all instances of IBM API Connect within the environment to identify versions 12.1.0.0 through 12.1.1.2.
  • Apply the latest vendor security patches to remediate CVE-2026-17049 immediately.
  • Review access logs and API audit trails for suspicious patterns of unauthorized document modification or unexpected data retrieval requests associated with authenticated user accounts.
]]>criticaladvisory