{"id":"CVE-2026-16854","kind":"vulnerability","aliases":["CVE-2026-16854"],"related":[],"title":"IBM API Connect 12.1.0.0-12.1.1.2: SQL injection lets authenticated users read other tenants' data; fixed in 12.1.1.3","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to an injection vulnerability. Input used to build a data query is not properly neutralized, which could allow the query to return data the user is not permitted to see.","summary":"IBM API Connect V12 OnPrem 12.1.0.0 through 12.1.1.2 does not neutralize input used to build a data query (CWE-89, SQL injection). A remote authenticated attacker can make the query return other tenants' data. IBM rates it CVSS 7.7 and lists no workaround.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":"12.1.0.0 - 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","multi-tenant","self-hosted"],"not_affected_if":["no-authenticated-users","outside-version-range","single-tenant","unaffected-version"],"how_to_check":"Check the installed API Connect V12 OnPrem version: affected are 12.1.0.0 to 12.1.1.2. 12.1.1.3 and later are fixed. Deployments with more than one tenant are the ones where data crosses tenants.","fix":"Upgrade to API Connect 12.1.1.3 via IBM Fix Central (https://www.ibm.com/support/pages/node/7290205). IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:22+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","triaged_at":"2026-11-07T05:50:54+00:00","updated_at":"2026-11-07T06:26:14+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:50:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: query injection leaks other tenants' data to authenticated users","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 let a logged-in user inject input into a data query, so the query returns records they should not see. An attacker gets sensitive information that belongs to other tenants.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","multi-tenant","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads other tenants' sensitive data","analyst_note":"Find IBM's security bulletin for CVE-2026-16854 to confirm the fixed version and any workaround; the NVD entry gives only the affected range.","how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- Confirm whether your deployment is multi-tenant, since the impact is cross-tenant data exposure","plain_action":"","needs_analyst":true,"not_affected_if":["outside-version-range","single-tenant","no-authenticated-users"],"who_is_affected":"Teams running IBM API Connect 12.1.0.0 through 12.1.1.2 where more than one tenant shares the deployment. Exposure requires a valid user account on the platform. Single-tenant deployments and other versions are outside the stated range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000702,"input_tokens":4238,"output_tokens":556,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-16854 to confirm the fixed version and any workaround; the NVD entry gives only the affected range.","search":"'-16854':20A,23A '-2026':19A,22A '-89':61B '12.1.0.0':4A,47B,88C '12.1.1.2':5A,49B,90C '12.1.1.3':17A '7.7':80B 'allow':92C,123C 'api':2A,24A,29B,33B,43B,86C 'api-gateway':28B 'attack':67B,96C 'authent':9A,66B,95C 'belong':101C 'build':56B,113C 'connect':3A,25A,34B,44B,87C 'could':91C,122C 'cve':18A,21A 'cvss':79B 'cwe':60B 'data':14A,58B,75B,115C,128C 'due':105C 'fix':15A 'gateway':30B 'host':41B 'ibm':1A,32B,42B,76B,85C 'ibm-api-connect':31B 'inform':100C 'infrastructur':35B 'inject':7A,63B,108C 'input':53B,110C 'let':8A 'list':82B 'make':69B 'multi':37B 'multi-ten':36B 'neutral':52B,120C 'obtain':98C 'onprem':27A,46B 'permit':133C 'proper':119C 'queri':59B,71B,116C,125C 'rate':77B 'read':11A 'remot':65B,94C 'return':72B,127C 'see':135C 'self':40B 'self-host':39B 'sensit':99C 'sql':6A,62B 'tenant':13A,38B,74B,104C 'use':54B,111C 'user':10A,130C 'v12':26A,45B 'vulner':109C 'workaround':84B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect 12.1.0.0 through 12.1.1.2 where more than one tenant shares the deployment. Exposure requires a valid user account on the platform. Single-tenant deployments and other versions are outside the stated range.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:26:14Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2073},"products":{"at":"2026-11-07T06:26:14Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2073},"mitigations":{"at":"2026-11-07T06:26:14Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2073},"workarounds":{"at":"2026-11-07T06:26:14Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2073},"how_to_check":{"at":"2026-11-07T06:26:14Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2073},"who_affected":{"at":"2026-11-07T06:26:14Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2073}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","infrastructure","multitenant","selfhosted"],"campaign_type":null,"search_a":"'-16854':20A,23A '-2026':19A,22A '12.1.0.0':4A '12.1.1.2':5A '12.1.1.3':17A 'api':2A,24A 'authent':9A 'connect':3A,25A 'cve':18A,21A 'data':14A 'fix':15A 'ibm':1A 'inject':7A 'let':8A 'onprem':27A 'read':11A 'sql':6A 'tenant':13A 'user':10A 'v12':26A","search_b":"'-89':61B '12.1.0.0':47B '12.1.1.2':49B '7.7':80B 'api':29B,33B,43B 'api-gateway':28B 'attack':67B 'authent':66B 'build':56B 'connect':34B,44B 'cvss':79B 'cwe':60B 'data':58B,75B 'gateway':30B 'host':41B 'ibm':32B,42B,76B 'ibm-api-connect':31B 'infrastructur':35B 'inject':63B 'input':53B 'list':82B 'make':69B 'multi':37B 'multi-ten':36B 'neutral':52B 'onprem':46B 'queri':59B,71B 'rate':77B 'remot':65B 'return':72B 'self':40B 'self-host':39B 'sql':62B 'tenant':38B,74B 'use':54B 'v12':45B 'workaround':84B","search_c":"'12.1.0.0':88C '12.1.1.2':90C 'allow':92C,123C 'api':86C 'attack':96C 'authent':95C 'belong':101C 'build':113C 'connect':87C 'could':91C,122C 'data':115C,128C 'due':105C 'ibm':85C 'inform':100C 'inject':108C 'input':110C 'neutral':120C 'obtain':98C 'permit':133C 'proper':119C 'queri':116C,125C 'remot':94C 'return':127C 'see':135C 'sensit':99C 'tenant':104C 'use':111C 'user':130C 'vulner':109C","first_public_at":"2026-11-07T05:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16854","severity":null,"published_at":"2026-11-07T05:18:22+00:00","modified_at":"2026-11-07T05:18:22+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","fetched_at":"2026-11-07T05:45:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-16854:2073","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:26:14+00:00","modified_at":"2026-11-07T06:26:14+00:00","first_seen_at":"2026-11-07T06:26:14+00:00","fetched_at":"2026-11-07T06:26:14+00:00","note":"Read IBM bulletin -39 (v12.1.1.3): CVE-2026-16854 CWE-89 SQL injection, CVSS 7.7 S:C. Affected V12 OnPrem 12.1.0.0-12.1.1.2, fix 12.1.1.3, workarounds None. No exploitation/PoC checked on X.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}