{"id":"CVE-2026-16711","kind":"vulnerability","aliases":["CVE-2026-16711"],"related":[],"title":"IBM API Connect: remote input flaw can leak platform credentials in outbound requests","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to inject platform credentials into outbound requests due to improper input validation. A validation check is not sufficiently strict, which could cause platform credentials to be included in outbound requests.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to validate input strictly enough. A remote attacker can cause platform credentials to be included in outbound requests.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure"],"not_affected_if":["version-outside-affected-ranges"],"how_to_check":"- Check the installed IBM API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.","fix":null,"status":"open","published_at":"2026-11-07T05:18:20+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","triaged_at":"2026-11-07T05:54:12+00:00","updated_at":"2026-11-07T05:54:12+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:54:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: remote input flaw can leak platform credentials in outbound requests","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to validate input strictly enough. A remote attacker can cause platform credentials to be included in outbound requests.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Platform credentials leak through outbound requests to attacker-controlled destinations","analyst_note":"Check the IBM security bulletin for this CVE to confirm the fixed versions and required configuration; the NVD entry gives only the affected ranges.","how_to_check":"- Check the installed IBM API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks: the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"who_is_affected":"Teams that run IBM API Connect in the affected version ranges are exposed. The sources do not say which deployment configurations or features are required to trigger the flaw, so unknown whether a default install is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000699,"input_tokens":4257,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-16711':16A,19A '-2026':15A,18A '10.0.8.0':32B,61C '10.0.8.12':34B,63C '12.1.0.0':36B,65C '12.1.1.2':38B,67C 'allow':69C 'api':2A,21B,25B,29B,59C 'api-gateway':20B 'attack':47B,72C 'caus':49B,94C 'check':87C 'connect':3A,26B,30B,60C 'could':68C,93C 'credenti':10A,51B,76C,96C 'cve':14A,17A 'due':80C 'enough':44B 'fail':39B 'flaw':6A 'gateway':22B 'ibm':1A,24B,28B,58C 'ibm-api-connect':23B 'improp':82C 'includ':54B,99C 'infrastructur':27B 'inject':74C 'input':5A,42B,83C 'leak':8A 'outbound':12A,56B,78C,101C 'platform':9A,50B,75C,95C 'remot':4A,46B,71C 'request':13A,57B,79C,102C 'strict':43B,91C 'suffici':90C 'valid':41B,84C,86C 'version':31B","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM API Connect in the affected version ranges are exposed. The sources do not say which deployment configurations or features are required to trigger the flaw, so unknown whether a default install is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","infrastructure","medium"],"campaign_type":null,"search_a":"'-16711':16A,19A '-2026':15A,18A 'api':2A 'connect':3A 'credenti':10A 'cve':14A,17A 'flaw':6A 'ibm':1A 'input':5A 'leak':8A 'outbound':12A 'platform':9A 'remot':4A 'request':13A","search_b":"'10.0.8.0':32B '10.0.8.12':34B '12.1.0.0':36B '12.1.1.2':38B 'api':21B,25B,29B 'api-gateway':20B 'attack':47B 'caus':49B 'connect':26B,30B 'credenti':51B 'enough':44B 'fail':39B 'gateway':22B 'ibm':24B,28B 'ibm-api-connect':23B 'includ':54B 'infrastructur':27B 'input':42B 'outbound':56B 'platform':50B 'remot':46B 'request':57B 'strict':43B 'valid':41B 'version':31B","search_c":"'10.0.8.0':61C '10.0.8.12':63C '12.1.0.0':65C '12.1.1.2':67C 'allow':69C 'api':59C 'attack':72C 'caus':94C 'check':87C 'connect':60C 'could':68C,93C 'credenti':76C,96C 'due':80C 'ibm':58C 'improp':82C 'includ':99C 'inject':74C 'input':83C 'outbound':78C,101C 'platform':75C,95C 'remot':71C 'request':79C,102C 'strict':91C 'suffici':90C 'valid':84C,86C","first_public_at":"2026-11-07T05:18:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16711","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16711","severity":null,"published_at":"2026-11-07T05:18:20+00:00","modified_at":"2026-11-07T05:18:20+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","fetched_at":"2026-11-07T05:45:57+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}