{"id":"CVE-2026-17172","kind":"vulnerability","aliases":["CVE-2026-17172"],"related":[],"title":"IBM API Connect 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2: authenticated user can impersonate another party; fixed in 10.0.8.13 and 12.1.1.3","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another party.","summary":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not sufficiently verify client-supplied information during authentication. A remote attacker with a valid account can bypass security restrictions and impersonate another party. IBM rates it CVSS 8.5 (attack complexity high) and lists no workaround.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":"10.0.8.0 - 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":"12.1.0.0 - 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["unaffected-version","version-outside-affected-ranges"],"how_to_check":"Check the installed API Connect version: affected are 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2 (V12 OnPrem per IBM). Fixed in 10.0.8.13 and 12.1.1.3.","fix":"Upgrade to API Connect 10.0.8.13 (10.0.8.x) or 12.1.1.3 (12.1.x), via IBM Fix Central. IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:29+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","triaged_at":"2026-11-07T05:50:19+00:00","updated_at":"2026-11-07T06:24:10+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-07T05:50:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: authenticated attacker can impersonate another party","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not sufficiently verify client-supplied information during authentication. A remote attacker with a valid account can bypass security restrictions and impersonate another party.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated caller impersonates another party and bypasses restrictions","analyst_note":"Find IBM's security bulletin for CVE-2026-17172 to confirm the fixed versions and any configuration that matters.","how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"who_is_affected":"Organizations that run IBM API Connect in the affected version ranges, where remote users hold valid accounts. Deployments on versions outside 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2 are not in the stated range. The sources do not describe which configurations or API endpoints are involved.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00072,"input_tokens":4256,"output_tokens":588,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17172 to confirm the fixed versions and any configuration that matters.","search":"'-17172':22A,25A '-2026':21A,24A '10.0.8.0':4A,46B,93C '10.0.8.12':5A,48B,95C '10.0.8.13':17A '12.1.0.0':7A,50B,97C '12.1.1.2':8A,52B,99C '12.1.1.3':19A '8.5':82B 'account':69B 'allow':101C,125C 'anoth':13A,76B,130C 'api':2A,26A,28A,33B,37B,44B,91C 'api-gateway':32B 'attack':65B,83B,105C 'authent':9A,62B,104C,113C 'bypass':71B,107C 'caller':127C 'client':58B,118C 'client-suppli':57B 'complex':84B 'connect':3A,27A,29A,38B,45B,92C 'could':100C,124C 'cve':20A,23A 'cvss':81B 'due':110C 'fix':15A 'gateway':34B 'high':85B 'host':42B 'ibm':1A,36B,43B,78B,90C 'ibm-api-connect':35B 'imperson':12A,75B,129C 'improp':112C 'inform':60B,114C 'infrastructur':39B 'list':87B 'onprem':31A 'parti':14A,77B,131C 'rate':79B 'remot':64B,103C 'restrict':73B,109C 'secur':72B,108C 'self':41B 'self-host':40B 'suffici':55B,121C 'suppli':59B,115C 'user':10A 'v12':30A 'valid':68B 'verifi':56B,122C 'workaround':89B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2. A logged-in user could pass off another party's identity because client-supplied information is not sufficiently verified; IBM rates the attack as high complexity. IBM lists no workaround, so upgrading is the only remedy. Teams not running API Connect can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:24:10Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2068},"products":{"at":"2026-11-07T06:24:10Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2068},"mitigations":{"at":"2026-11-07T06:24:10Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2068},"workarounds":{"at":"2026-11-07T06:24:10Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2068},"how_to_check":{"at":"2026-11-07T06:24:10Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2068},"who_affected":{"at":"2026-11-07T06:24:10Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2068}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","connect","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17172':22A,25A '-2026':21A,24A '10.0.8.0':4A '10.0.8.12':5A '10.0.8.13':17A '12.1.0.0':7A '12.1.1.2':8A '12.1.1.3':19A 'anoth':13A 'api':2A,26A,28A 'authent':9A 'connect':3A,27A,29A 'cve':20A,23A 'fix':15A 'ibm':1A 'imperson':12A 'onprem':31A 'parti':14A 'user':10A 'v12':30A","search_b":"'10.0.8.0':46B '10.0.8.12':48B '12.1.0.0':50B '12.1.1.2':52B '8.5':82B 'account':69B 'anoth':76B 'api':33B,37B,44B 'api-gateway':32B 'attack':65B,83B 'authent':62B 'bypass':71B 'client':58B 'client-suppli':57B 'complex':84B 'connect':38B,45B 'cvss':81B 'gateway':34B 'high':85B 'host':42B 'ibm':36B,43B,78B 'ibm-api-connect':35B 'imperson':75B 'inform':60B 'infrastructur':39B 'list':87B 'parti':77B 'rate':79B 'remot':64B 'restrict':73B 'secur':72B 'self':41B 'self-host':40B 'suffici':55B 'suppli':59B 'valid':68B 'verifi':56B 'workaround':89B","search_c":"'10.0.8.0':93C '10.0.8.12':95C '12.1.0.0':97C '12.1.1.2':99C 'allow':101C,125C 'anoth':130C 'api':91C 'attack':105C 'authent':104C,113C 'bypass':107C 'caller':127C 'client':118C 'connect':92C 'could':100C,124C 'due':110C 'ibm':90C 'imperson':129C 'improp':112C 'inform':114C 'parti':131C 'remot':103C 'restrict':109C 'secur':108C 'suffici':121C 'suppli':115C 'verifi':122C","first_public_at":"2026-11-07T05:18:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17172","severity":null,"published_at":"2026-11-07T05:18:29+00:00","modified_at":"2026-11-07T05:18:29+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","fetched_at":"2026-11-07T05:45:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17172:2068","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:24:10+00:00","modified_at":"2026-11-07T06:24:10+00:00","first_seen_at":"2026-11-07T06:24:10+00:00","fetched_at":"2026-11-07T06:24:10+00:00","note":"Read IBM bulletins -41 (10.0.8.x) and -39 (12.1.x): CVE listed, CWE-290, CVSS 8.5 AV:N/AC:H/PR:L/S:C. Fix 10.0.8.13 / 12.1.1.3; IBM workarounds: None. No exploitation or PoC seen (X not searched). -41 metadata inconsistently lists 10.0.8.13 as affected; body says 10.0.8.0-10.0.8.12.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}