API CONNECT V12 ONPREM · CVE-2026-17147 · Vendor
FIX → 12.1.1.3 ✓ verified
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal flaw. A remote attacker with a valid account can execute arbitrary code and perform unauthorized administrative actions.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted IBM API Connect V12 OnPrem v12.1.0.0 to v12.1.1.2 is affected. An attacker needs a valid account on the product, then can use path traversal to run code and take administrative actions. 10.0.8.x is listed by NVD only and not confirmed by IBM for this CVE.
Who cares api-gateway, ibm-api-connect, self-hosted
v12.1.0.0 through v12.1.1.210.0.8.x install (10.0.8.0-10.0.8.12), which NVD lists but IBM's bulletin for this CVE does not confirmUpgrade to 12.1.1.3
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions due to a path traversal vulnerability.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)