API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2) - CraftedSignal Threat Feed

IBM API Connect: Server-side request forgery (CVE-2026-17289)

hello@craftedsignal.io — Sat, 07 Nov 2026 07:52:26 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF). This flaw allows a remote authenticated attacker to obtain sensitive information. The vulnerability has a CVSS v3.1 base score of 7.7.

IBM API Connect: Denial of Service via uncontrolled resource consumption (CVE-2026-17279)

hello@craftedsignal.io — Sat, 07 Nov 2026 07:51:49 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that permits an authenticated remote attacker to perform a denial of service attack. By sending specially crafted requests, an attacker can trigger uncontrolled resource consumption within the system, resulting in stalled internal processing and service unavailability.

Impact

Successful exploitation results in service unavailability, preventing legitimate users from accessing API Connect services. The vulnerability carries a CVSS v3.1 base score of 7.7.

Recommendation

Inventory all instances of IBM API Connect within the environment and verify version numbers against the affected ranges. Monitor vendor security updates and apply patches as they become available to remediate CVE-2026-17279.

IBM API Connect: Server-side request forgery (CVE-2026-18836)

hello@craftedsignal.io — Sat, 07 Nov 2026 07:51:19 +0000

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.

IBM API Connect: Account takeover via OAuth 2.0 open redirect (CVE-2026-17291)

hello@craftedsignal.io — Sat, 07 Nov 2026 06:06:34 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an open redirect vulnerability during OAuth 2.0 sign-in, which may allow a remote authenticated attacker to have authentication results sent to an attacker-controlled location, potentially leading to account takeover.

IBM API Connect: Information disclosure via external references (CVE-2026-17285)

hello@craftedsignal.io — Sat, 07 Nov 2026 06:05:55 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability (CVE-2026-17285) that permits an authenticated remote attacker to obtain sensitive information. The flaw stems from improper validation of external references when the application processes schemas, allowing the server to fetch content from unauthorized external resources.

Impact

Successful exploitation allows a remote authenticated attacker to access and retrieve sensitive information from external resources that the server should not have permission to reach.

Recommendation

Inventory instances of IBM API Connect within your environment to identify versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2.
Review vendor security bulletins for the release of patches addressing CVE-2026-17285 and schedule upgrades immediately upon availability.
Review API gateway configuration logs for abnormal outbound requests originating from the API Connect server towards internal or external unauthorized endpoints.

IBM API Connect: Cross-tenant unauthorized operations (CVE-2026-17284)

hello@craftedsignal.io — Sat, 07 Nov 2026 06:05:45 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where improper validation of client-supplied information and insufficient verification of tenant context could allow a remote authenticated attacker to perform unauthorized operations on resources belonging to other tenants.

IBM API Connect: Cross-site scripting vulnerability (CVE-2026-17190)

hello@craftedsignal.io — Sat, 07 Nov 2026 06:02:51 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a cross-site scripting vulnerability identified as CVE-2026-17190. The vulnerability exists because HTML content supplied by a provider is not sufficiently sanitized before display, which could allow script content to run in the user's browser.

Technical Details

A remote authenticated attacker can leverage this vulnerability to execute arbitrary JavaScript.

IBM API Connect: Broken Object-Level Authorization (CVE-2026-17112)

hello@craftedsignal.io — Sat, 07 Nov 2026 06:01:59 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a broken object-level authorization (BOLA) vulnerability. An authenticated attacker can exploit this flaw to bypass tenant isolation and access sensitive data belonging to other tenants within the multi-tenant API environment.

Impact

Successful exploitation allows a remote authenticated attacker to read sensitive information belonging to other tenants, leading to unauthorized data exposure.

Recommendation

Identify and inventory instances of IBM API Connect within the environment. Review vendor security bulletins for available patches for the affected versions (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2) and apply updates immediately.

IBM API Connect: Arbitrary code execution (CVE-2026-105002)

hello@craftedsignal.io — Sat, 07 Nov 2026 05:59:34 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow arbitrary code to be executed by the management service in certain non-default configurations. This is caused by improper control of generation of code, where customization content may be evaluated as code. This vulnerability is only possible where the related feature is enabled and not properly restricted.

IBM API Connect: SQL injection vulnerability (CVE-2026-17396)

hello@craftedsignal.io — Sat, 07 Nov 2026 05:56:01 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability. A remote authenticated attacker can exploit this flaw to gain unauthorized access to sensitive information stored within the application database.

Impact

Successful exploitation allows for the unauthorized retrieval of sensitive data, posing a critical risk to data confidentiality within the affected API management environments.

Recommendation

Inventory all deployed instances of IBM API Connect to identify versions within the affected ranges (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2).
Monitor IBM security bulletins for the release of patches or configuration-based mitigations for CVE-2026-17396.
Implement strict input validation and parameterized queries for all custom API development performed on the IBM API Connect platform to reduce the surface area for SQL injection.

IBM API Connect: Unauthorized tenant access via LDAP injection (CVE-2026-17392)

hello@craftedsignal.io — Sat, 07 Nov 2026 05:55:48 +0000

IBM API Connect contains an LDAP injection vulnerability due to improper neutralization of user-supplied input in directory queries. An authenticated remote attacker can exploit this flaw to manipulate the logic of LDAP queries, potentially leading to unauthorized administrative access to other tenants within the environment. As of the current disclosure, IBM has released advisory information; administrators should verify their current version against the affected ranges.

Impact

The vulnerability allows an authenticated attacker to bypass standard authorization controls, resulting in unauthorized administrative access to tenants other than their own. The vulnerability is rated with a CVSS v3.1 base score of 9.9.

Recommendation

Identify all instances of IBM API Connect within the environment and verify current versioning.
Review IBM security bulletins for the availability of patches addressing CVE-2026-17392.
Monitor API Connect access logs for anomalous administrative behavior or high-frequency directory queries originating from standard user accounts.

IBM API Connect: Authentication bypass via improper signature verification (CVE-2026-17301)

hello@craftedsignal.io — Sat, 07 Nov 2026 05:52:05 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to an authentication bypass vulnerability. This flaw arises from the improper verification of cryptographic signatures, which an unauthenticated attacker could potentially exploit to bypass security controls and gain unauthorized access to the application.

Impact

Successful exploitation allows an unauthenticated attacker to bypass authentication, potentially resulting in unauthorized access to API management functions and sensitive data. The vulnerability is rated with a CVSS v3.1 base score of 9.8.

Recommendation

Inventory all instances of IBM API Connect within the environment to identify systems running the vulnerable version ranges (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2).
Review IBM security advisories for the release of security patches addressing CVE-2026-17301 and apply the appropriate update immediately upon availability.
Monitor API gateway access logs for anomalous authentication patterns or requests targeting sensitive endpoints originating from unauthorized sources.

IBM API Connect: Open redirect account takeover (CVE-2026-17297)

hello@craftedsignal.io — Sat, 07 Nov 2026 05:51:44 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an open redirect vulnerability. The redirect address used during the sign-in process is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location. This vulnerability carries a CVSS v3.1 base score of 9.6.

IBM API Connect: Broken object-level authorization (CVE-2026-17292)

hello@craftedsignal.io — Sat, 07 Nov 2026 05:51:27 +0000

IBM API Connect contains a broken object-level authorization (BOLA) vulnerability (CVE-2026-17292) caused by incomplete access checks on organization objects. A remote authenticated attacker can leverage this flaw to modify the ownership of organizations they do not control, leading to unauthorized privilege escalation and takeover of organizational resources.

Impact

Successful exploitation allows a remote authenticated attacker to gain full administrative control over target organizations, potentially resulting in unauthorized access to sensitive API data, configuration modifications, and full resource takeover.

Recommendation

Inventory all instances of IBM API Connect within the environment to identify versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.
Prioritize the application of vendor-supplied security patches or version upgrades as documented in official IBM security bulletins for CVE-2026-17292.
Implement monitoring for administrative configuration changes within API Connect to detect anomalous organization ownership transfers.

IBM API Connect: Remote code execution and tenant isolation bypass (CVE-2026-17150)

hello@craftedsignal.io — Sat, 07 Nov 2026 05:50:54 +0000

CVE-2026-17150 describes a vulnerability in IBM API Connect resulting from insufficient input validation of uploaded custom modules. An authenticated remote attacker can exploit this flaw to execute arbitrary code within the application environment. Due to the nature of the vulnerability, successful exploitation enables a tenant to bypass security boundaries, potentially accessing sensitive information belonging to other tenants.

Impact

Successful exploitation allows for arbitrary code execution on the server hosting the API Connect instance and enables cross-tenant data access, compromising the confidentiality and integrity of all tenants within the affected environment.

Recommendation

Audit all current custom module deployments within the IBM API Connect environment to identify any unauthorized or suspicious modifications.
Prioritize upgrading to the latest patched version of IBM API Connect as released by IBM.
Review access logs for API endpoints associated with module uploads and management to identify unauthorized authentication or anomalous administrative activity.

IBM API Connect: Remote code execution via object attribute modification (CVE-2026-17117)

hello@craftedsignal.io — Sat, 07 Nov 2026 05:50:12 +0000

CVE-2026-17117 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows an authenticated remote user to manipulate object attributes that are intended to be restricted to system use. Successful exploitation enables the execution of arbitrary code within the context of the affected application.

Impact

Successful exploitation allows for remote code execution by authenticated users, potentially leading to full system compromise of the API Connect instance.

Recommendation

Inventory IBM API Connect instances to identify versions within the 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 ranges.
Review IBM security bulletins for the release of fixed firmware or software updates and prioritize patching of internet-facing instances.
Monitor authentication logs for suspicious administrative activity or unauthorized API call patterns targeting object configuration endpoints.

IBM API Connect: Server-side request forgery (CVE-2026-16918)

hello@craftedsignal.io — Sat, 07 Nov 2026 05:49:38 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a server-side request forgery (SSRF) vulnerability. This vulnerability could allow a remote attacker to access internal network resources. The vulnerability is assigned a CVSS v3.1 base score of 9.3.