{"id":"CVE-2026-17139","kind":"vulnerability","aliases":["CVE-2026-17139"],"related":[],"title":"IBM API Connect: stored script injection via URL fields runs in other users' browsers","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not validate certain URL fields. A remote attacker with a valid account can plant script content there that runs in another user's browser session.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-api-connect","self-hosted","vendor"],"not_affected_if":["outside-affected-versions"],"how_to_check":"- Check the installed API Connect version against the affected ranges, 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.","fix":null,"status":"open","published_at":"2026-11-07T05:18:27+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","triaged_at":"2026-11-07T05:54:09+00:00","updated_at":"2026-11-07T05:54:09+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:54:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: stored script injection via URL fields runs in other users' browsers","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not validate certain URL fields. A remote attacker with a valid account can plant script content there that runs in another user's browser session.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Script runs in another user's browser session, exposing their session.","analyst_note":"Find IBM's security bulletin for CVE-2026-17139 to confirm the fixed version and the affected URL fields.","how_to_check":"- Check the installed API Connect version against the affected ranges, 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for any other check; the sources do not say which URL fields or settings are involved.","plain_action":"","needs_analyst":true,"not_affected_if":["outside-affected-versions"],"who_is_affected":"Teams that run IBM API Connect in the affected version ranges are exposed, and an attacker needs an authenticated account that can reach the affected URL fields. Installations outside those ranges are not affected according to the sources. The sources do not say which URL fields or roles are involved.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000706,"input_tokens":4261,"output_tokens":559,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17139':17A,20A '-2026':16A,19A '10.0.8.0':33B,69C '10.0.8.12':35B,71C '12.1.0.0':37B,73C '12.1.1.2':39B,75C 'account':52B 'allow':77C 'anoth':61B,106C 'api':2A,23B,30B,67C 'arbitrari':84C 'attack':48B,81C 'authent':80C 'browser':14A,64B,109C 'certain':43B,92C 'connect':3A,24B,31B,68C 'content':56B,102C 'could':76C,103C 'cross':89C 'cross-sit':88C 'cve':15A,18A 'due':86C 'execut':83C 'field':9A,45B,94C 'host':27B 'ibm':1A,22B,29B,66C 'ibm-api-connect':21B 'inject':6A 'malici':100C 'plant':54B 'remot':47B,79C 'run':10A,59B,104C 'script':5A,55B,85C,91C,101C 'self':26B 'self-host':25B 'session':65B,110C 'site':90C 'store':4A 'suffici':97C 'url':8A,44B,93C 'user':13A,62B,107C 'valid':42B,51B,98C 'vendor':28B 'version':32B 'via':7A","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM API Connect in the affected version ranges are exposed, and an attacker needs an authenticated account that can reach the affected URL fields. Installations outside those ranges are not affected according to the sources. The sources do not say which URL fields or roles are involved.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmapiconnect","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17139':17A,20A '-2026':16A,19A 'api':2A 'browser':14A 'connect':3A 'cve':15A,18A 'field':9A 'ibm':1A 'inject':6A 'run':10A 'script':5A 'store':4A 'url':8A 'user':13A 'via':7A","search_b":"'10.0.8.0':33B '10.0.8.12':35B '12.1.0.0':37B '12.1.1.2':39B 'account':52B 'anoth':61B 'api':23B,30B 'attack':48B 'browser':64B 'certain':43B 'connect':24B,31B 'content':56B 'field':45B 'host':27B 'ibm':22B,29B 'ibm-api-connect':21B 'plant':54B 'remot':47B 'run':59B 'script':55B 'self':26B 'self-host':25B 'session':65B 'url':44B 'user':62B 'valid':42B,51B 'vendor':28B 'version':32B","search_c":"'10.0.8.0':69C '10.0.8.12':71C '12.1.0.0':73C '12.1.1.2':75C 'allow':77C 'anoth':106C 'api':67C 'arbitrari':84C 'attack':81C 'authent':80C 'browser':109C 'certain':92C 'connect':68C 'content':102C 'could':76C,103C 'cross':89C 'cross-sit':88C 'due':86C 'execut':83C 'field':94C 'ibm':66C 'malici':100C 'remot':79C 'run':104C 'script':85C,91C,101C 'session':110C 'site':90C 'suffici':97C 'url':93C 'user':107C 'valid':98C","first_public_at":"2026-11-07T05:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17139","severity":null,"published_at":"2026-11-07T05:18:27+00:00","modified_at":"2026-11-07T05:18:27+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","fetched_at":"2026-11-07T05:45:59+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}