{"id":"CVE-2026-17129","kind":"vulnerability","aliases":["CVE-2026-17129"],"related":[],"title":"IBM API Connect V12 OnPrem 12.1.0.0-12.1.1.2: authenticated users can read sensitive data and crash service; fixed in 12.1.1.3","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference.","summary":"IBM API Connect V12 OnPrem 12.1.0.0 through 12.1.1.2 has an insecure direct object reference (CWE-639). A remote authenticated user can reach objects they should not see, obtaining sensitive information and causing a denial of service. IBM rates it CVSS 7.6 and lists no workaround.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":"12.1.0.0 - 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","auth-required","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["auth-required","outside-affected-versions","unaffected-version"],"how_to_check":"Check the installed API Connect V12 OnPrem version: affected are 12.1.0.0 to 12.1.1.2. Fixed in 12.1.1.3. IBM's bulletin for 10.0.8.x (-41) does not list this CVE; 10.0.8.x is not confirmed affected.","fix":"Upgrade API Connect V12 OnPrem to 12.1.1.3 (IBM Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:26+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","triaged_at":"2026-11-07T05:52:04+00:00","updated_at":"2026-11-07T06:25:10+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-07T05:52:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can read sensitive data and crash service","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 have an insecure direct object reference flaw. A logged-in remote user can reach objects they should not see, leaking sensitive information and causing a denial of service.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads sensitive data and crashes service","analyst_note":"Check IBM's security bulletin for CVE-2026-17129 for the fixed version and affected endpoints; the NVD entry alone gives no fix.","how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["outside-affected-versions"],"who_is_affected":"Organizations running IBM API Connect in the 12.1.0.0 to 12.1.1.2 range are exposed to authenticated remote users. Who can skip it: teams on other versions or without API Connect. The sources do not describe the specific endpoints or configuration involved.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00068,"input_tokens":4203,"output_tokens":519,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for CVE-2026-17129 for the fixed version and affected endpoints; the NVD entry alone gives no fix.","search":"'-17129':22A,25A '-2026':21A,24A '-639':59B '12.1.0.0':6A,49B,92C '12.1.1.2':7A,51B,94C '12.1.1.3':19A '7.6':84B 'allow':96C 'api':2A,26A,31B,38B,45B,90C 'api-gateway':30B 'attack':100C 'auth':34B 'auth-requir':33B 'authent':8A,62B,99C 'caus':75B,106C 'connect':3A,27A,39B,46B,91C 'could':95C 'crash':15A 'cve':20A,23A 'cvss':83B 'cwe':58B 'data':13A 'denial':77B,108C 'direct':55B,115C 'due':111C 'fix':17A 'gateway':32B 'host':42B 'ibm':1A,37B,44B,80B,89C 'ibm-api-connect':36B 'inform':73B,104C 'insecur':54B,114C 'list':86B 'object':56B,66B,116C 'obtain':71B,102C 'onprem':5A,29A,48B 'rate':81B 'reach':65B 'read':11A 'refer':57B,117C 'remot':61B,98C 'requir':35B 'see':70B 'self':41B 'self-host':40B 'sensit':12A,72B,103C 'servic':16A,79B,110C 'user':9A,63B 'v12':4A,28A,47B 'vendor':43B 'workaround':88B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect V12 OnPrem 12.1.0.0 through 12.1.1.2. Any logged-in user could read objects they should not see and degrade the service. IBM lists no workaround, so upgrading to 12.1.1.3 is the remedy. Teams on 10.0.8.x (not listed by IBM for this CVE) or not running API Connect can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:25:10Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2069},"products":{"at":"2026-11-07T06:25:10Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2069},"mitigations":{"at":"2026-11-07T06:25:10Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2069},"workarounds":{"at":"2026-11-07T06:25:10Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2069},"how_to_check":{"at":"2026-11-07T06:25:10Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2069},"who_affected":{"at":"2026-11-07T06:25:10Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2069}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authrequired","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17129':22A,25A '-2026':21A,24A '12.1.0.0':6A '12.1.1.2':7A '12.1.1.3':19A 'api':2A,26A 'authent':8A 'connect':3A,27A 'crash':15A 'cve':20A,23A 'data':13A 'fix':17A 'ibm':1A 'onprem':5A,29A 'read':11A 'sensit':12A 'servic':16A 'user':9A 'v12':4A,28A","search_b":"'-639':59B '12.1.0.0':49B '12.1.1.2':51B '7.6':84B 'api':31B,38B,45B 'api-gateway':30B 'auth':34B 'auth-requir':33B 'authent':62B 'caus':75B 'connect':39B,46B 'cvss':83B 'cwe':58B 'denial':77B 'direct':55B 'gateway':32B 'host':42B 'ibm':37B,44B,80B 'ibm-api-connect':36B 'inform':73B 'insecur':54B 'list':86B 'object':56B,66B 'obtain':71B 'onprem':48B 'rate':81B 'reach':65B 'refer':57B 'remot':61B 'requir':35B 'see':70B 'self':41B 'self-host':40B 'sensit':72B 'servic':79B 'user':63B 'v12':47B 'vendor':43B 'workaround':88B","search_c":"'12.1.0.0':92C '12.1.1.2':94C 'allow':96C 'api':90C 'attack':100C 'authent':99C 'caus':106C 'connect':91C 'could':95C 'denial':108C 'direct':115C 'due':111C 'ibm':89C 'inform':104C 'insecur':114C 'object':116C 'obtain':102C 'refer':117C 'remot':98C 'sensit':103C 'servic':110C","first_public_at":"2026-11-07T05:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17129","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17129","severity":null,"published_at":"2026-11-07T05:18:26+00:00","modified_at":"2026-11-07T05:18:26+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","fetched_at":"2026-11-07T05:45:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17129:2069","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:25:10+00:00","modified_at":"2026-11-07T06:25:10+00:00","first_seen_at":"2026-11-07T06:25:10+00:00","fetched_at":"2026-11-07T06:25:10+00:00","note":"Read IBM bulletin -39 (12.1.1.3): CVE listed, CVSS 7.6, affected V12 OnPrem 12.1.0.0-12.1.1.2, fix 12.1.1.3, workarounds None. -41 (10.0.8.13) does not list it. No exploitation/PoC checked on X.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}