{"id":"CVE-2026-17146","kind":"vulnerability","aliases":["CVE-2026-17146"],"related":[],"title":"IBM API Connect: authenticated users can run JavaScript (cross-site scripting) and read sensitive data (fixed in 10.0.8.13)","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to validate input properly. A remote attacker with a valid account can execute arbitrary JavaScript and obtain sensitive information.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"api-connect-v12-onprem","fixed":[],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","auth-required","ibm-api-connect","self-hosted","vendor","xss"],"not_affected_if":["version-outside-range"],"how_to_check":"Check your API Connect version. Affected per NVD: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. Fixed on 10.0.8.x: 10.0.8.13.","fix":"10.0.8.13 for the 10.0.8.x branch (IBM bulletin). For 12.1.x, IBM's v12.1.1.3 bulletin is the likely fix, but this CVE was not seen in the portion read; confirm on the bulletin.","status":"open","published_at":"2026-11-07T05:18:27+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","triaged_at":"2026-11-07T05:48:11+00:00","updated_at":"2026-11-07T05:59:08+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-07T05:48:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: authenticated users can run JavaScript and read sensitive data","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to validate input properly. A remote attacker with a valid account can execute arbitrary JavaScript and obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs JavaScript and reads sensitive information from the platform","analyst_note":"Find IBM's security bulletin for CVE-2026-17146 to confirm the fixed version, the affected component and whether user interaction is needed.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges are exposed to authenticated remote attackers. The sources do not describe the specific configuration or feature that makes a deployment reachable, so teams should confirm their version range first.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000697,"input_tokens":4237,"output_tokens":547,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17146 to confirm the fixed version, the affected component and whether user interaction is needed.","search":"'-17146':22A,25A '-2026':21A,24A '10.0.8.0':53B,83C '10.0.8.12':55B,85C '10.0.8.13':19A '12.1.0.0':57B,87C '12.1.1.2':59B,89C 'account':71B 'allow':91C 'api':2A,27A,30A,35B,42B,50B,81C 'api-connect':26A 'api-connect-v12-onprem':29A 'api-gateway':34B 'arbitrari':74B,98C 'attack':67B,95C 'auth':38B 'auth-requir':37B 'authent':4A,94C 'connect':3A,28A,31A,43B,51B,82C 'could':90C 'cross':10A 'cross-sit':9A 'cve':20A,23A 'data':16A 'due':104C 'execut':73B,97C 'fail':60B 'fix':17A 'gateway':36B 'host':46B 'ibm':1A,41B,49B,80C 'ibm-api-connect':40B 'improp':106C 'inform':79B,103C 'input':63B,107C 'javascript':8A,75B,99C 'obtain':77B,101C 'onprem':33A 'proper':64B 'read':14A 'remot':66B,93C 'requir':39B 'run':7A 'script':12A 'self':45B 'self-host':44B 'sensit':15A,78B,102C 'site':11A 'user':5A 'v12':32A 'valid':62B,70B,108C 'vendor':47B 'version':52B 'xss':48B","nicknames":[],"mitigations":[],"who_affected":"Teams that run self-managed IBM API Connect 10.0.8.0 to 10.0.8.12 or 12.1.0.0 to 12.1.1.2. IBM classes it as cross-site scripting (CWE-79) reachable by a remote user with a valid account, no user interaction (CVSS 9.9, scope changed). Teams on 10.0.8.13 or later can skip it.","tier":"B","verified":{"how_to_check":{"at":"2026-11-07T05:59:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1991}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authrequired","critical","ibmapiconnect","selfhosted","vendor","xss"],"campaign_type":null,"search_a":"'-17146':22A,25A '-2026':21A,24A '10.0.8.13':19A 'api':2A,27A,30A 'api-connect':26A 'api-connect-v12-onprem':29A 'authent':4A 'connect':3A,28A,31A 'cross':10A 'cross-sit':9A 'cve':20A,23A 'data':16A 'fix':17A 'ibm':1A 'javascript':8A 'onprem':33A 'read':14A 'run':7A 'script':12A 'sensit':15A 'site':11A 'user':5A 'v12':32A","search_b":"'10.0.8.0':53B '10.0.8.12':55B '12.1.0.0':57B '12.1.1.2':59B 'account':71B 'api':35B,42B,50B 'api-gateway':34B 'arbitrari':74B 'attack':67B 'auth':38B 'auth-requir':37B 'connect':43B,51B 'execut':73B 'fail':60B 'gateway':36B 'host':46B 'ibm':41B,49B 'ibm-api-connect':40B 'inform':79B 'input':63B 'javascript':75B 'obtain':77B 'proper':64B 'remot':66B 'requir':39B 'self':45B 'self-host':44B 'sensit':78B 'valid':62B,70B 'vendor':47B 'version':52B 'xss':48B","search_c":"'10.0.8.0':83C '10.0.8.12':85C '12.1.0.0':87C '12.1.1.2':89C 'allow':91C 'api':81C 'arbitrari':98C 'attack':95C 'authent':94C 'connect':82C 'could':90C 'due':104C 'execut':97C 'ibm':80C 'improp':106C 'inform':103C 'input':107C 'javascript':99C 'obtain':101C 'remot':93C 'sensit':102C 'valid':108C","first_public_at":"2026-11-07T05:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17146","severity":null,"published_at":"2026-11-07T05:18:27+00:00","modified_at":"2026-11-07T05:18:27+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","fetched_at":"2026-11-07T05:45:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17146:1991","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T05:59:08+00:00","modified_at":"2026-11-07T05:59:08+00:00","first_seen_at":"2026-11-07T05:59:08+00:00","fetched_at":"2026-11-07T05:59:08+00:00","note":"IBM bulletin -41 (10.0.8.13) lists CVE-2026-17146 (CWE-79, CVSS 9.9, authenticated, no UI). 12.1.x bulletin -39 (v12.1.1.3) read but page truncated before this CVE, so 12.1 fix not confirmed for this CVE; sibling CVEs use 12.1.1.3. No exploitation/PoC found.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}