{"id":"CVE-2026-17230","kind":"vulnerability","aliases":["CVE-2026-17230"],"related":[],"title":"IBM API Connect: path traversal lets signed-in users read sensitive information","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal flaw. A remote attacker with a valid account can use it to obtain sensitive information.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2","fix":null,"status":"open","published_at":"2026-11-07T05:18:31+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","triaged_at":"2026-11-07T05:54:05+00:00","updated_at":"2026-11-07T05:54:05+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:54:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: path traversal lets signed-in users read sensitive information","impact":"low","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal flaw. A remote attacker with a valid account can use it to obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive information from the server via path traversal","analyst_note":"Check the IBM security bulletin for this CVE to confirm the fixed version and which endpoints are affected; NVD page at https://nvd.nist.gov/vuln/detail/CVE-2026-17230 gave no fix detail.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where an authenticated user can reach the vulnerable path handling. Deployments on versions outside those ranges are not affected. The sources do not say which endpoints or configurations are exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":4229,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17230':16A,19A '-2026':15A,18A '10.0.8.0':32B,61C '10.0.8.12':34B,63C '12.1.0.0':36B,65C '12.1.1.2':38B,67C 'account':50B 'allow':69C 'api':2A,21B,25B,29B,59C 'api-gateway':20B 'attack':46B,73C 'authent':72C 'connect':3A,26B,30B,60C 'contain':39B 'could':68C 'cve':14A,17A 'due':78C 'flaw':43B 'gateway':22B 'ibm':1A,24B,28B,58C 'ibm-api-connect':23B 'inform':13A,57B,77C 'let':6A 'obtain':55B,75C 'path':4A,41B,81C 'read':11A 'remot':45B,71C 'sensit':12A,56B,76C 'sign':8A 'signed-in':7A 'travers':5A,42B,82C 'use':52B 'user':10A 'valid':49B 'vendor':27B 'version':31B 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges, where an authenticated user can reach the vulnerable path handling. Deployments on versions outside those ranges are not affected. The sources do not say which endpoints or configurations are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","medium","vendor"],"campaign_type":null,"search_a":"'-17230':16A,19A '-2026':15A,18A 'api':2A 'connect':3A 'cve':14A,17A 'ibm':1A 'inform':13A 'let':6A 'path':4A 'read':11A 'sensit':12A 'sign':8A 'signed-in':7A 'travers':5A 'user':10A","search_b":"'10.0.8.0':32B '10.0.8.12':34B '12.1.0.0':36B '12.1.1.2':38B 'account':50B 'api':21B,25B,29B 'api-gateway':20B 'attack':46B 'connect':26B,30B 'contain':39B 'flaw':43B 'gateway':22B 'ibm':24B,28B 'ibm-api-connect':23B 'inform':57B 'obtain':55B 'path':41B 'remot':45B 'sensit':56B 'travers':42B 'use':52B 'valid':49B 'vendor':27B 'version':31B","search_c":"'10.0.8.0':61C '10.0.8.12':63C '12.1.0.0':65C '12.1.1.2':67C 'allow':69C 'api':59C 'attack':73C 'authent':72C 'connect':60C 'could':68C 'due':78C 'ibm':58C 'inform':77C 'obtain':75C 'path':81C 'remot':71C 'sensit':76C 'travers':82C 'vulner':83C","first_public_at":"2026-11-07T05:18:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17230","severity":null,"published_at":"2026-11-07T05:18:31+00:00","modified_at":"2026-11-07T05:18:31+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","fetched_at":"2026-11-07T05:46:00+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}