{"id":"CVE-2026-17154","kind":"vulnerability","aliases":["CVE-2026-17154"],"related":[],"title":"IBM API Connect: authenticated users can inject cross-site scripting","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform cross-site scripting due to improper neutralization of user-supplied input.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 fail to neutralize user-supplied input, enabling cross-site scripting. An authenticated attacker can run scripts in another user's browser session.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-api-connect","self-hosted","vendor"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`","fix":null,"status":"open","published_at":"2026-11-07T05:18:28+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","triaged_at":"2026-11-07T05:54:08+00:00","updated_at":"2026-11-07T05:54:08+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:54:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can inject cross-site scripting","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 fail to neutralize user-supplied input, enabling cross-site scripting. An authenticated attacker can run scripts in another user's browser session.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs scripts in other users' browser sessions","analyst_note":"","how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 are in the affected range. The sources do not say which features or roles expose the input, so the exposure surface is unknown. Teams on other versions can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000643,"input_tokens":4200,"output_tokens":446,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17154':14A,17A '-2026':13A,16A '12.1.0.0':30B,60C '12.1.1.2':32B,62C 'allow':64C 'anoth':52B 'api':2A,20B,27B,58C 'attack':47B,68C 'authent':4A,46B,67C 'browser':55B 'connect':3A,21B,28B,59C 'could':63C 'cross':9A,42B,72C 'cross-sit':8A,41B,71C 'cve':12A,15A 'due':75C 'enabl':40B 'fail':33B 'host':24B 'ibm':1A,19B,26B,57C 'ibm-api-connect':18B 'improp':77C 'inject':7A 'input':39B,83C 'neutral':35B,78C 'perform':70C 'remot':66C 'run':49B 'script':11A,44B,50B,74C 'self':23B 'self-host':22B 'session':56B 'site':10A,43B,73C 'suppli':38B,82C 'user':5A,37B,53B,81C 'user-suppli':36B,80C 'vendor':25B 'version':29B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 are in the affected range. The sources do not say which features or roles expose the input, so the exposure surface is unknown. Teams on other versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmapiconnect","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17154':14A,17A '-2026':13A,16A 'api':2A 'authent':4A 'connect':3A 'cross':9A 'cross-sit':8A 'cve':12A,15A 'ibm':1A 'inject':7A 'script':11A 'site':10A 'user':5A","search_b":"'12.1.0.0':30B '12.1.1.2':32B 'anoth':52B 'api':20B,27B 'attack':47B 'authent':46B 'browser':55B 'connect':21B,28B 'cross':42B 'cross-sit':41B 'enabl':40B 'fail':33B 'host':24B 'ibm':19B,26B 'ibm-api-connect':18B 'input':39B 'neutral':35B 'run':49B 'script':44B,50B 'self':23B 'self-host':22B 'session':56B 'site':43B 'suppli':38B 'user':37B,53B 'user-suppli':36B 'vendor':25B 'version':29B","search_c":"'12.1.0.0':60C '12.1.1.2':62C 'allow':64C 'api':58C 'attack':68C 'authent':67C 'connect':59C 'could':63C 'cross':72C 'cross-sit':71C 'due':75C 'ibm':57C 'improp':77C 'input':83C 'neutral':78C 'perform':70C 'remot':66C 'script':74C 'site':73C 'suppli':82C 'user':81C 'user-suppli':80C","first_public_at":"2026-11-07T05:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17154","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17154","severity":null,"published_at":"2026-11-07T05:18:28+00:00","modified_at":"2026-11-07T05:18:28+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","fetched_at":"2026-11-07T05:45:59+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}