{"id":"CVE-2026-17150","kind":"vulnerability","aliases":["CVE-2026-17150"],"related":[],"title":"IBM API Connect: uploaded modules let a tenant run code across tenants","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not validate uploaded custom module content before processing it. An authenticated user can run code and reach data belonging to other tenants.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13","12.1.1.3"],"affected":">= 10.0.8.0, <= 10.0.8.12; >= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","multi-tenant"],"not_affected_if":["no-custom-module-upload","single-tenant-deployment","versions-outside-range"],"how_to_check":"- Check your API Connect version: affected are 10.0.8.0 through 10.0.8.12 and v12.1.0.0 through v12.1.1.2 (12 OnPrem).\n- Check whether any tenant or user can upload custom module content; those are the users who can trigger it (needs an authenticated account).\n- IBM lists no workarounds, so upgrade.","fix":"Upgrade to API Connect 10.0.8.13 (10.0.8.x) or v12.1.1.3 (12.1.x), via IBM Fix Central. IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:28+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","triaged_at":"2026-11-07T05:48:10+00:00","updated_at":"2026-11-07T05:59:31+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:48:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: uploaded modules let a tenant run code across tenants","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not validate uploaded custom module content before processing it. An authenticated user can run code and reach data belonging to other tenants.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","multi-tenant","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Code runs with access beyond the user's tenant; other tenants' data readable.","analyst_note":"Find the IBM security bulletin for CVE-2026-17150 to confirm the fixed versions and any required settings.","how_to_check":"- Check the installed API Connect version in the product's management console or release notes.\n- Look for tenants that can upload custom modules.","plain_action":"","needs_analyst":true,"not_affected_if":["single-tenant-deployment","no-custom-module-upload","versions-outside-range"],"who_is_affected":"Organisations running IBM API Connect in a multi-tenant setup where users can upload custom module content. Single-tenant deployments that do not let users upload custom modules are less exposed. The sources do not say which configurations are most at risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000692,"input_tokens":4282,"output_tokens":528,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-17150 to confirm the fixed versions and any required settings.","search":"'-17150':15A,18A '-2026':14A,17A '10.0.8.0':36B,69C '10.0.8.12':38B,71C '12.1.0.0':40B,73C '12.1.1.2':42B,75C 'access':87C,117C 'across':11A 'allow':77C,112C 'api':2A,19A,22B,26B,33B,67C 'api-gateway':21B 'arbitrari':84C 'attack':81C 'authent':54B,80C 'belong':62B 'beyond':118C 'code':10A,58B,85C,113C 'connect':3A,20A,27B,34B,68C 'content':49B,101C 'could':76C,111C 'custom':47B,99C 'cve':13A,16A 'data':61B 'due':93C 'execut':83C 'gateway':23B 'ibm':1A,25B,32B,66C 'ibm-api-connect':24B 'inform':89C 'infrastructur':28B 'input':96C 'insuffici':95C 'let':6A 'modul':5A,48B,100C 'multi':30B 'multi-ten':29B 'process':51B,109C 'reach':60B 'remot':79C 'run':9A,57B,115C 'sensit':88C 'suffici':104C 'tenant':8A,12A,31B,65B,92C,123C 'upload':4A,46B,98C 'user':55B,120C 'valid':45B,97C,105C 'version':35B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect 10.0.8.0 to 10.0.8.12, or 12.1.0.0 to 12.1.1.2 (on-prem), where authenticated users can upload custom module content. A user with a valid account can run code and read data belonging to other tenants, so multi-tenant gateways are the main concern. Versions 10.0.8.13 and 12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:59:31Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1989},"products":{"at":"2026-11-07T05:59:31Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1989},"workarounds":{"at":"2026-11-07T05:59:31Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1989},"how_to_check":{"at":"2026-11-07T05:59:31Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1989},"who_affected":{"at":"2026-11-07T05:59:31Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1989}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","connect"],"ptokens":["api","connect"],"labels":["apigateway","critical","ibmapiconnect","infrastructure","multitenant"],"campaign_type":null,"search_a":"'-17150':15A,18A '-2026':14A,17A 'across':11A 'api':2A,19A 'code':10A 'connect':3A,20A 'cve':13A,16A 'ibm':1A 'let':6A 'modul':5A 'run':9A 'tenant':8A,12A 'upload':4A","search_b":"'10.0.8.0':36B '10.0.8.12':38B '12.1.0.0':40B '12.1.1.2':42B 'api':22B,26B,33B 'api-gateway':21B 'authent':54B 'belong':62B 'code':58B 'connect':27B,34B 'content':49B 'custom':47B 'data':61B 'gateway':23B 'ibm':25B,32B 'ibm-api-connect':24B 'infrastructur':28B 'modul':48B 'multi':30B 'multi-ten':29B 'process':51B 'reach':60B 'run':57B 'tenant':31B,65B 'upload':46B 'user':55B 'valid':45B 'version':35B","search_c":"'10.0.8.0':69C '10.0.8.12':71C '12.1.0.0':73C '12.1.1.2':75C 'access':87C,117C 'allow':77C,112C 'api':67C 'arbitrari':84C 'attack':81C 'authent':80C 'beyond':118C 'code':85C,113C 'connect':68C 'content':101C 'could':76C,111C 'custom':99C 'due':93C 'execut':83C 'ibm':66C 'inform':89C 'input':96C 'insuffici':95C 'modul':100C 'process':109C 'remot':79C 'run':115C 'sensit':88C 'suffici':104C 'tenant':92C,123C 'upload':98C 'user':120C 'valid':97C,105C","first_public_at":"2026-11-07T05:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17150","severity":null,"published_at":"2026-11-07T05:18:28+00:00","modified_at":"2026-11-07T05:18:28+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","fetched_at":"2026-11-07T05:45:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17150:1989","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T05:59:31+00:00","modified_at":"2026-11-07T05:59:31+00:00","first_seen_at":"2026-11-07T05:59:31+00:00","fetched_at":"2026-11-07T05:59:31+00:00","note":"IBM bulletins (10.0.8.x: ...-41; 12.1.x: ...-39) list CVE-2026-17150, CWE-184, CVSS 9.9; fixes 10.0.8.13 and v12.1.1.3; no workarounds. Exploitation/PoC not checked; no posts searched.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}