{"id":"CVE-2026-17114","kind":"vulnerability","aliases":["CVE-2026-17114"],"related":[],"title":"IBM API Connect: error messages leak sensitive data and enable denial of service","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to the generation of error messages containing sensitive information.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 generate error messages that contain sensitive information. A remote attacker with an account can read that information and cause a denial of service.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2","fix":null,"status":"open","published_at":"2026-11-07T05:18:25+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","triaged_at":"2026-11-07T05:54:09+00:00","updated_at":"2026-11-07T05:54:09+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:54:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: error messages leak sensitive data and enable denial of service","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 generate error messages that contain sensitive information. A remote attacker with an account can read that information and cause a denial of service.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive data from errors and disrupts the service","analyst_note":"Check the IBM security bulletin for this CVE to confirm the fixed versions and any configuration that affects exposure; the NVD entry alone does not state a fix.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organisations running IBM API Connect in the affected version ranges, where an authenticated remote user can trigger the error messages. The sources do not describe specific configurations that change exposure. Teams on other versions are not listed as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000693,"input_tokens":4241,"output_tokens":538,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17114':16A,19A '-2026':15A,18A '10.0.8.0':32B,65C '10.0.8.12':34B,67C '12.1.0.0':36B,69C '12.1.1.2':38B,71C 'account':51B 'allow':73C 'api':2A,21B,25B,29B,63C 'api-gateway':20B 'attack':48B,77C 'authent':76C 'caus':57B,83C 'connect':3A,26B,30B,64C 'contain':43B,95C 'could':72C 'cve':14A,17A 'data':8A 'denial':11A,59B,85C 'due':88C 'enabl':10A 'error':4A,40B,93C 'gateway':22B 'generat':39B,91C 'ibm':1A,24B,28B,62C 'ibm-api-connect':23B 'inform':45B,55B,81C,97C 'leak':6A 'messag':5A,41B,94C 'obtain':79C 'read':53B 'remot':47B,75C 'sensit':7A,44B,80C,96C 'servic':13A,61B,87C 'vendor':27B 'version':31B","nicknames":[],"mitigations":[],"who_affected":"Organisations running IBM API Connect in the affected version ranges, where an authenticated remote user can trigger the error messages. The sources do not describe specific configurations that change exposure. Teams on other versions are not listed as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","medium","vendor"],"campaign_type":null,"search_a":"'-17114':16A,19A '-2026':15A,18A 'api':2A 'connect':3A 'cve':14A,17A 'data':8A 'denial':11A 'enabl':10A 'error':4A 'ibm':1A 'leak':6A 'messag':5A 'sensit':7A 'servic':13A","search_b":"'10.0.8.0':32B '10.0.8.12':34B '12.1.0.0':36B '12.1.1.2':38B 'account':51B 'api':21B,25B,29B 'api-gateway':20B 'attack':48B 'caus':57B 'connect':26B,30B 'contain':43B 'denial':59B 'error':40B 'gateway':22B 'generat':39B 'ibm':24B,28B 'ibm-api-connect':23B 'inform':45B,55B 'messag':41B 'read':53B 'remot':47B 'sensit':44B 'servic':61B 'vendor':27B 'version':31B","search_c":"'10.0.8.0':65C '10.0.8.12':67C '12.1.0.0':69C '12.1.1.2':71C 'allow':73C 'api':63C 'attack':77C 'authent':76C 'caus':83C 'connect':64C 'contain':95C 'could':72C 'denial':85C 'due':88C 'error':93C 'generat':91C 'ibm':62C 'inform':81C,97C 'messag':94C 'obtain':79C 'remot':75C 'sensit':80C,96C 'servic':87C","first_public_at":"2026-11-07T05:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17114","severity":null,"published_at":"2026-11-07T05:18:25+00:00","modified_at":"2026-11-07T05:18:25+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","fetched_at":"2026-11-07T05:45:58+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}