---
id: "CVE-2026-17150"
page: "https://infrastack.ai/live/CVE-2026-17150"
kind: "vulnerability"
aliases: ["CVE-2026-17150"]
title: "IBM API Connect: uploaded modules let a tenant run code across tenants"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "API Connect", "fixed": ["10.0.8.13", "12.1.1.3"], "affected": ">= 10.0.8.0, <= 10.0.8.12; >= 12.1.0.0, <= 12.1.1.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["api-gateway", "ibm-api-connect", "infrastructure", "multi-tenant"]
not_affected_if: ["no-custom-module-upload", "single-tenant-deployment", "versions-outside-range"]
published_at: "2026-11-07T05:18:28+00:00"
first_seen_at: "2026-11-07T05:45:59+00:00"
updated_at: "2026-11-07T05:59:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17150", "first_seen_at": "2026-11-07T05:45:59+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41", "first_seen_at": "2026-11-07T05:59:31+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41", "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}]
exploit_sources: []
---

# IBM API Connect: uploaded modules let a tenant run code across tenants

Link for people: https://infrastack.ai/live/CVE-2026-17150 (this .md is for agents)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not validate uploaded custom module content before processing it. An authenticated user can run code and reach data belonging to other tenants.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:API Connect affected >= 10.0.8.0, <= 10.0.8.12; >= 12.1.0.0, <= 12.1.1.2 fixed 10.0.8.13, 12.1.1.3

## How to check

- Check your API Connect version: affected are 10.0.8.0 through 10.0.8.12 and v12.1.0.0 through v12.1.1.2 (12 OnPrem).
- Check whether any tenant or user can upload custom module content; those are the users who can trigger it (needs an authenticated account).
- IBM lists no workarounds, so upgrade.

## Fix

Upgrade to API Connect 10.0.8.13 (10.0.8.x) or v12.1.1.3 (12.1.x), via IBM Fix Central. IBM lists no workarounds.

## Timeline

- 2026-11-07T05:45:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17150
- 2026-11-07T05:59:31+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41 — IBM bulletins (10.0.8.x: ...-41; 12.1.x: ...-39) list CVE-2026-17150, CWE-184, CVSS 9.9; fixes 10.0.8.13 and v12.1.1.3; no workarounds. Exploitation/PoC not checked; no posts searched.

## Documents

- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41
- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39

## From the sources

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_