API Connect (10.0.8.0 Through 10.0.8.12 and 12.1.0.0 Through 12.1.1.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/api-connect-10.0.8.0-through-10.0.8.12-and-12.1.0.0-through-12.1.1.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 09:57:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgIBM API Connect: Arbitrary JavaScript execution and information disclosure (CVE-2026-17146)https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-b607459c/Sat, 07 Nov 2026 09:57:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-b607459c/IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a flaw caused by improper input validation, allowing a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information.<p>IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability (CVE-2026-17146) caused by improper input validation. This flaw could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information.</p> criticaladvisoryIBM API Connect: Server-side request forgery (CVE-2026-17294)https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-8a0cb215/Sat, 07 Nov 2026 06:07:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-8a0cb215/IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.<p>IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.</p> highadvisoryIBM API Connect: Unauthorized account creation vulnerability (CVE-2026-17290)https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vulnerability-d51e014b/Sat, 07 Nov 2026 06:06:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vulnerability-d51e014b/IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to create unauthorized user accounts by forging identity provider data due to insufficient cryptographic signature verification.IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability related to the processing of identity information from external login providers. The system fails to fully verify the cryptographic signatures of incoming identity assertions, which permits an attacker to provide forged identity data to the application. Successful exploitation allows a remote authenticated attacker to create unauthorized user accounts within the environment.

Impact

An attacker can bypass identity provider validation logic to create arbitrary user accounts, potentially leading to unauthorized system access or privilege escalation within the context of the API Connect platform.

Recommendation

  • Inventory all deployed IBM API Connect instances to identify those running vulnerable version ranges (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2).
  • Consult the IBM product security portal for specific patches or configuration updates addressing CVE-2026-17290.
  • Review administrative logs for suspicious user account creation events, specifically those originating from external authentication provider integrations.
]]>highadvisory