{"id":"CVE-2026-17190","kind":"vulnerability","aliases":["CVE-2026-17190"],"related":[],"title":"IBM API Connect: stored XSS in provider-supplied HTML runs scripts","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript due to cross-site scripting. HTML content supplied by a provider is not sufficiently sanitized before it is displayed, which could allow script content to run in the user's browser.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not sanitize HTML supplied by a provider before displaying it. An authenticated attacker can get script to run in another user's browser.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13","12.1.1.3"],"affected":">= 10.0.8.0, <= 10.0.8.12; >= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure"],"not_affected_if":["outside-affected-versions"],"how_to_check":"Check your API Connect version. Affected: 10.0.8.0 through 10.0.8.12, and 12.1.0.0 through 12.1.1.2. Fixed: 10.0.8.13 and 12.1.1.3.","fix":"Upgrade to API Connect 10.0.8.13 (10.0.8 line) or 12.1.1.3 (12.1 line) via IBM Fix Central. IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:29+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","triaged_at":"2026-11-07T05:48:50+00:00","updated_at":"2026-11-07T06:24:02+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-07T05:48:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: stored XSS in provider-supplied HTML runs scripts","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not sanitize HTML supplied by a provider before displaying it. An authenticated attacker can get script to run in another user's browser.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in other users' browsers and can act as them","analyst_note":"Confirm the fixed versions and which provider-facing HTML fields are affected in IBM's security bulletin for CVE-2026-17190.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["outside-affected-versions"],"who_is_affected":"Teams that run IBM API Connect in the affected version ranges and let providers supply HTML that other users view in the portal or console. The sources do not say which provider-facing features render that HTML, so the exposure path is unknown. Installations outside the listed ranges are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4273,"output_tokens":541,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and which provider-facing HTML fields are affected in IBM's security bulletin for CVE-2026-17190.","search":"'-17190':15A,18A '-2026':14A,17A '10.0.8.0':33B,67C '10.0.8.12':35B,69C '12.1.0.0':37B,71C '12.1.1.2':39B,73C 'allow':75C,106C 'anoth':60B 'api':2A,19A,22B,26B,30B,65C 'api-gateway':21B 'arbitrari':82C 'attack':53B,79C 'authent':52B,78C 'browser':63B,115C 'connect':3A,20A,27B,31B,66C 'content':91C,108C 'could':74C,105C 'cross':87C 'cross-sit':86C 'cve':13A,16A 'display':49B,103C 'due':84C 'execut':81C 'gateway':23B 'get':55B 'html':10A,43B,90C 'ibm':1A,25B,29B,64C 'ibm-api-connect':24B 'infrastructur':28B 'javascript':83C 'provid':8A,47B,95C 'provider-suppli':7A 'remot':77C 'run':11A,58B,110C 'sanit':42B,99C 'script':12A,56B,89C,107C 'site':88C 'store':4A 'suffici':98C 'suppli':9A,44B,92C 'user':61B,113C 'version':32B 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM API Connect in the affected version ranges and let providers supply HTML that other users view in the portal or console. The sources do not say which provider-facing features render that HTML, so the exposure path is unknown. Installations outside the listed ranges are not affected.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:24:02Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2065},"products":{"at":"2026-11-07T06:24:02Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2065},"how_to_check":{"at":"2026-11-07T06:24:02Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2065}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","connect"],"ptokens":["api","connect"],"labels":["apigateway","high","ibmapiconnect","infrastructure"],"campaign_type":null,"search_a":"'-17190':15A,18A '-2026':14A,17A 'api':2A,19A 'connect':3A,20A 'cve':13A,16A 'html':10A 'ibm':1A 'provid':8A 'provider-suppli':7A 'run':11A 'script':12A 'store':4A 'suppli':9A 'xss':5A","search_b":"'10.0.8.0':33B '10.0.8.12':35B '12.1.0.0':37B '12.1.1.2':39B 'anoth':60B 'api':22B,26B,30B 'api-gateway':21B 'attack':53B 'authent':52B 'browser':63B 'connect':27B,31B 'display':49B 'gateway':23B 'get':55B 'html':43B 'ibm':25B,29B 'ibm-api-connect':24B 'infrastructur':28B 'provid':47B 'run':58B 'sanit':42B 'script':56B 'suppli':44B 'user':61B 'version':32B","search_c":"'10.0.8.0':67C '10.0.8.12':69C '12.1.0.0':71C '12.1.1.2':73C 'allow':75C,106C 'api':65C 'arbitrari':82C 'attack':79C 'authent':78C 'browser':115C 'connect':66C 'content':91C,108C 'could':74C,105C 'cross':87C 'cross-sit':86C 'display':103C 'due':84C 'execut':81C 'html':90C 'ibm':64C 'javascript':83C 'provid':95C 'remot':77C 'run':110C 'sanit':99C 'script':89C,107C 'site':88C 'suffici':98C 'suppli':92C 'user':113C","first_public_at":"2026-11-07T05:18:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17190","severity":null,"published_at":"2026-11-07T05:18:29+00:00","modified_at":"2026-11-07T05:18:29+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","fetched_at":"2026-11-07T05:46:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17190:2065","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:24:02+00:00","modified_at":"2026-11-07T06:24:02+00:00","first_seen_at":"2026-11-07T06:24:02+00:00","fetched_at":"2026-11-07T06:24:02+00:00","note":"IBM bulletins (-41 for 10.0.8.13, -39 for 12.1.1.3) list CVE-2026-17190 (CWE-79, 8.7). Fixes: 10.0.8.13 and 12.1.1.3. Read the 10.0.8 table in full; the 12.1 bulletin was cut off, so I got its fix only from its summary line. No workaround listed. The specific HTML fields are not named by IBM. No exploitation or PoC found.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}