CVE-2026-17155 · Infrastructure
NO FIX YET
IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not neutralize user-controlled input properly. A remote attacker with a valid account can execute arbitrary scripts in the product.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organisations running IBM API Connect 12.1.0.0 through 12.1.1.2. Exposure requires an authenticated account on the product. Sources do not describe further conditions, so unknown whether non-default setups are needed.
Not affected if outside-affected-range
Who cares api-connect, ibm, self-hosted
No fix yet, per the sources.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of user-controlled input.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.