---
id: "CVE-2026-105002"
page: "https://infrastack.ai/live/CVE-2026-105002"
kind: "vulnerability"
aliases: ["CVE-2026-105002"]
title: "IBM API Connect: management service can run arbitrary code in non-default setups"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "api-connect", "fixed": ["10.0.8.13"], "affected": ">= 10.0.8.0, <= 10.0.8.12", "ecosystem": "vendor"}, {"name": "api-connect-v12-onprem", "fixed": ["12.1.1.3"], "affected": ">= 12.1.0.0, <= 12.1.1.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["api-gateway", "ibm-api-connect", "infrastructure", "self-hosted"]
not_affected_if: ["default-config", "feature-disabled"]
published_at: "2026-11-07T05:17:57+00:00"
first_seen_at: "2026-11-07T05:45:56+00:00"
updated_at: "2026-11-07T06:28:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105002", "first_seen_at": "2026-11-07T05:45:56+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/node/7295635", "first_seen_at": "2026-11-07T06:28:31+00:00", "cites": ["https://www.ibm.com/support/pages/node/7295635", "https://www.ibm.com/support/pages/node/7295637"]}]
exploit_sources: []
---

# IBM API Connect: management service can run arbitrary code in non-default setups

Link for people: https://infrastack.ai/live/CVE-2026-105002 (this .md is for agents)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 let the management service evaluate customization content as code. An attacker who can supply that content can execute code under the management service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:api-connect affected >= 10.0.8.0, <= 10.0.8.12 fixed 10.0.8.13
- vendor:api-connect-v12-onprem affected >= 12.1.0.0, <= 12.1.1.2 fixed 12.1.1.3

## How to check

- Check your API Connect version: 10.0.8.0 to 10.0.8.12 or V12 OnPrem 12.1.0.0 to 12.1.1.2 is affected; 10.0.8.13 and 12.1.1.3 are fixed.
- Then check whether the management service has the customization feature enabled and unrestricted. IBM's bulletin does not name the setting, so ask IBM support or review your management customization configuration.

## Fix

Upgrade to 10.0.8.13 (10.0.8 line) or v12.1.1.3 (V12 OnPrem). IBM lists no workaround or mitigation.

## Timeline

- 2026-11-07T05:45:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105002
- 2026-11-07T06:28:31+00:00 analyst https://www.ibm.com/support/pages/node/7295635 — IBM bulletins 7295635 (V12 OnPrem, fix v12.1.1.3) and 7295637 (10.0.8, fix 10.0.8.13) list CVE-2026-105002, CVSS 7.5, CWE-94; workarounds None. Setting name not given by IBM. Auth requirement only implied by PR:L. No exploitation or PoC seen.

## Documents

- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3) https://www.ibm.com/support/pages/node/7295635
- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13) https://www.ibm.com/support/pages/node/7295637

## From the sources

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow arbitrary code to be executed by the management service in certain non-default configurations due to improper control of generation of code. Customization content may be evaluated as code, which is only possible where the related feature is enabled and not properly restricted.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_