API CONNECT V12 ONPREM · CVE-2026-16854 · Infrastructure
FIX → 12.1.1.3 ✓ verified
IBM API Connect V12 OnPrem 12.1.0.0 through 12.1.1.2 does not neutralize input used to build a data query (CWE-89, SQL injection). A remote authenticated attacker can make the query return other tenants' data. IBM rates it CVSS 7.7 and lists no workaround.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running IBM API Connect 12.1.0.0 through 12.1.1.2 where more than one tenant shares the deployment. Exposure requires a valid user account on the platform. Single-tenant deployments and other versions are outside the stated range.
Not affected if no-authenticated-users, outside-version-range, single-tenant, unaffected-version
Who cares api-gateway, ibm-api-connect, multi-tenant, self-hosted
12.1.0.0 to 12.1.1.2. 12.1.1.3 and later are fixedIBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to an injection vulnerability. Input used to build a data query is not properly neutralized, which could allow the query to return data the user is not permitted to see.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 12.1.1.3
12.1.1.3 via IBM Fix Central (https://www.ibm.com/support/pages/node/7290205)