{"id":"CVE-2026-17137","kind":"vulnerability","aliases":["CVE-2026-17137"],"related":[],"title":"IBM API Connect: weak encryption on stored data exposes sensitive information","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to improper use of cryptography. The encryption applied to stored data is not implemented with sufficient strength, which weakens its protection.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 encrypt stored data with an insufficiently strong method. A local attacker who can read that stored data may recover sensitive information.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed IBM API Connect version against the affected range 12.1.0.0 through 12.1.1.2.","fix":null,"status":"open","published_at":"2026-11-07T05:18:26+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","triaged_at":"2026-11-07T05:54:33+00:00","updated_at":"2026-11-07T05:54:33+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:54:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"IBM API Connect: weak encryption on stored data exposes sensitive information","impact":"low","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 encrypt stored data with an insufficiently strong method. A local attacker who can read that stored data may recover sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local attacker reads sensitive information from weakly encrypted stored data","analyst_note":"Find the IBM security bulletin for CVE-2026-17137 to confirm the fixed version and which stored data is encrypted weakly.","how_to_check":"- Check the installed IBM API Connect version against the affected range 12.1.0.0 through 12.1.1.2.\n- unknown for other checks; the sources do not say which stored data or config is involved.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running IBM API Connect 12.1.0.0 through 12.1.1.2 where an attacker may already have local access to the host or its stored data. The sources do not say which stored data is affected or which configuration is needed. Systems outside that version range are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4219,"output_tokens":526,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17137':14A,17A '-2026':13A,16A '12.1.0.0':33B,60C '12.1.1.2':35B,62C 'allow':64C 'api':2A,19B,23B,30B,58C 'api-gateway':18B 'appli':80C 'attack':46B,67C 'connect':3A,24B,31B,59C 'could':63C 'cryptographi':77C 'cve':12A,15A 'data':8A,38B,52B,83C 'due':72C 'encrypt':5A,36B,79C 'expos':9A 'gateway':20B 'host':28B 'ibm':1A,22B,29B,57C 'ibm-api-connect':21B 'implement':86C 'improp':74C 'inform':11A,56B,71C 'infrastructur':25B 'insuffici':41B 'local':45B,66C 'may':53B 'method':43B 'obtain':69C 'protect':93C 'read':49B 'recov':54B 'self':27B 'self-host':26B 'sensit':10A,55B,70C 'store':7A,37B,51B,82C 'strength':89C 'strong':42B 'suffici':88C 'use':75C 'version':32B 'weak':4A 'weaken':91C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect 12.1.0.0 through 12.1.1.2 where an attacker may already have local access to the host or its stored data. The sources do not say which stored data is affected or which configuration is needed. Systems outside that version range are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-17137':14A,17A '-2026':13A,16A 'api':2A 'connect':3A 'cve':12A,15A 'data':8A 'encrypt':5A 'expos':9A 'ibm':1A 'inform':11A 'sensit':10A 'store':7A 'weak':4A","search_b":"'12.1.0.0':33B '12.1.1.2':35B 'api':19B,23B,30B 'api-gateway':18B 'attack':46B 'connect':24B,31B 'data':38B,52B 'encrypt':36B 'gateway':20B 'host':28B 'ibm':22B,29B 'ibm-api-connect':21B 'inform':56B 'infrastructur':25B 'insuffici':41B 'local':45B 'may':53B 'method':43B 'read':49B 'recov':54B 'self':27B 'self-host':26B 'sensit':55B 'store':37B,51B 'strong':42B 'version':32B","search_c":"'12.1.0.0':60C '12.1.1.2':62C 'allow':64C 'api':58C 'appli':80C 'attack':67C 'connect':59C 'could':63C 'cryptographi':77C 'data':83C 'due':72C 'encrypt':79C 'ibm':57C 'implement':86C 'improp':74C 'inform':71C 'local':66C 'obtain':69C 'protect':93C 'sensit':70C 'store':82C 'strength':89C 'suffici':88C 'use':75C 'weaken':91C","first_public_at":"2026-11-07T05:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17137","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17137","severity":null,"published_at":"2026-11-07T05:18:26+00:00","modified_at":"2026-11-07T05:18:26+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","fetched_at":"2026-11-07T05:45:58+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}