API Connect (12.1.0.0-12.1.1.2) - CraftedSignal Threat Feed

IBM API Connect: Hard-coded credentials remote administrative access (CVE-2026-17403)

hello@craftedsignal.io — Sat, 07 Nov 2026 07:51:02 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability involving the use of hard-coded credentials. This vulnerability could allow a remote attacker to gain full administrative control. The CVSS v3.1 base score for this vulnerability is 9.0.

IBM API Connect: Arbitrary file write via path traversal (CVE-2026-17354)

hello@craftedsignal.io — Sat, 07 Nov 2026 07:50:52 +0000

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability. A remote authenticated attacker can exploit this flaw to perform arbitrary file writes.

IBM API Connect: Server-side request forgery (CVE-2026-17188)

hello@craftedsignal.io — Sat, 07 Nov 2026 06:02:38 +0000

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker can exploit this flaw by providing malicious references to external resources during the service definition import process. Successful exploitation allows the server to make requests to internal or restricted network resources, potentially leading to information disclosure.

Impact

An authenticated attacker can abuse the API import feature to perform reconnaissance on internal network infrastructure or access unauthorized services that are otherwise unreachable from the internet.

Recommendation

Inventory all instances of IBM API Connect and identify those running versions 12.1.0.0 through 12.1.1.2.
Monitor API gateway logs for unusual outbound requests originating from the API Connect server, particularly those targeting internal IP ranges or sensitive internal management interfaces.
Apply the latest vendor security patches provided by IBM for API Connect to remediate CVE-2026-17188.

IBM API Connect: Remote authenticated code execution (CVE-2026-17399)

hello@craftedsignal.io — Sat, 07 Nov 2026 05:56:07 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authenticated remote code execution vulnerability identified as CVE-2026-17399. The flaw originates from the application's failure to adequately validate content prior to processing uploaded files. A remote authenticated attacker can leverage this to trigger arbitrary code execution on the underlying server.

Impact

Successful exploitation allows for arbitrary code execution on the server hosting the IBM API Connect software. This grants the attacker potential control over the application environment and the ability to access or manipulate data managed by the API gateway.

Recommendation

Identify all instances of IBM API Connect in the infrastructure and verify the version numbers against the affected ranges.
Apply the latest vendor security patches provided by IBM to remediate CVE-2026-17399.
Restrict administrative or file-upload access to the IBM API Connect management interfaces to trusted users only to minimize the risk of exploitation by compromised credentials.

IBM API Connect: Insecure tenant authorization (CVE-2026-17066)

hello@craftedsignal.io — Sat, 07 Nov 2026 05:50:01 +0000

CVE-2026-17066 identifies a critical broken access control vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw allows a remote authenticated attacker to bypass authorization checks within a multi-tenant environment. Successful exploitation grants the attacker the ability to view, modify, or delete sensitive information belonging to other tenants. No patch availability is specified in the NVD notice; administrators should monitor vendor security portals for immediate updates.

Impact

Successful exploitation allows for unauthorized information disclosure, data manipulation, and data destruction across tenant boundaries. This represents a complete compromise of tenant isolation for affected installations.

Recommendation

Inventory all IBM API Connect deployments to identify instances running versions 12.1.0.0 through 12.1.1.2.
Restrict administrative and tenant-level access to the API Connect management console until a vendor-supplied patch is applied.
Audit tenant activity logs for anomalous cross-tenant data access patterns or unauthorized modification attempts.
Review vendor-provided security bulletins for the release of fixed versions of IBM API Connect.