{"id":"CVE-2026-17098","kind":"vulnerability","aliases":["CVE-2026-17098"],"related":[],"title":"IBM API Connect: verbose error messages leak sensitive information to remote attackers","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to verbose error messages.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 return verbose error messages. A remote attacker can obtain sensitive information from those errors.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","vendor"],"not_affected_if":[],"how_to_check":"- Check the installed IBM API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.","fix":null,"status":"open","published_at":"2026-11-07T05:18:24+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","triaged_at":"2026-11-07T05:54:12+00:00","updated_at":"2026-11-07T05:54:12+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:54:12Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"IBM API Connect: verbose error messages leak sensitive information to remote attackers","impact":"low","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 return verbose error messages. A remote attacker can obtain sensitive information from those errors.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Sensitive information exposed through verbose error messages","analyst_note":"Find the IBM security bulletin for CVE-2026-17098 to confirm the fixed version and any required configuration.","how_to_check":"- Check the installed IBM API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running IBM API Connect in the affected version ranges, where remote requests can trigger verbose error output. The sources do not say which deployment or configuration choices make an instance reachable or exposed. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00067,"input_tokens":4221,"output_tokens":495,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17098':15A,18A '-2026':14A,17A '10.0.8.0':31B,55C '10.0.8.12':33B,57C '12.1.0.0':35B,59C '12.1.1.2':37B,61C 'allow':63C 'api':2A,20B,24B,28B,53C 'api-gateway':19B 'attack':12A,44B,66C 'connect':3A,25B,29B,54C 'could':62C 'cve':13A,16A 'due':71C 'error':5A,40B,51B,74C 'gateway':21B 'ibm':1A,23B,27B,52C 'ibm-api-connect':22B 'inform':9A,48B,70C 'leak':7A 'messag':6A,41B,75C 'obtain':46B,68C 'remot':11A,43B,65C 'return':38B 'sensit':8A,47B,69C 'vendor':26B 'verbos':4A,39B,73C 'version':30B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect in the affected version ranges, where remote requests can trigger verbose error output. The sources do not say which deployment or configuration choices make an instance reachable or exposed. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","medium","vendor"],"campaign_type":null,"search_a":"'-17098':15A,18A '-2026':14A,17A 'api':2A 'attack':12A 'connect':3A 'cve':13A,16A 'error':5A 'ibm':1A 'inform':9A 'leak':7A 'messag':6A 'remot':11A 'sensit':8A 'verbos':4A","search_b":"'10.0.8.0':31B '10.0.8.12':33B '12.1.0.0':35B '12.1.1.2':37B 'api':20B,24B,28B 'api-gateway':19B 'attack':44B 'connect':25B,29B 'error':40B,51B 'gateway':21B 'ibm':23B,27B 'ibm-api-connect':22B 'inform':48B 'messag':41B 'obtain':46B 'remot':43B 'return':38B 'sensit':47B 'vendor':26B 'verbos':39B 'version':30B","search_c":"'10.0.8.0':55C '10.0.8.12':57C '12.1.0.0':59C '12.1.1.2':61C 'allow':63C 'api':53C 'attack':66C 'connect':54C 'could':62C 'due':71C 'error':74C 'ibm':52C 'inform':70C 'messag':75C 'obtain':68C 'remot':65C 'sensit':69C 'verbos':73C","first_public_at":"2026-11-07T05:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17098","severity":null,"published_at":"2026-11-07T05:18:24+00:00","modified_at":"2026-11-07T05:18:24+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","fetched_at":"2026-11-07T05:45:58+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}