{"id":"CVE-2026-17231","kind":"vulnerability","aliases":["CVE-2026-17231"],"related":[],"title":"IBM API Connect: response discrepancy lets a remote attacker obtain sensitive information","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an observable response discrepancy.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 leak information through an observable difference in server responses. A remote attacker can use that difference to obtain sensitive data.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed IBM API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.","fix":"- Move to a release outside the affected ranges; the specific fixed version is unknown, as the sources do not state it.","status":"open","published_at":"2026-11-07T05:18:31+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","triaged_at":"2026-11-07T05:52:51+00:00","updated_at":"2026-11-07T05:52:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:52:51Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release outside the affected ranges; the specific fixed version is unknown, as the sources do not state it.","reach":"internet","title":"IBM API Connect: response discrepancy lets a remote attacker obtain sensitive information","impact":"low","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 leak information through an observable difference in server responses. A remote attacker can use that difference to obtain sensitive data.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker obtains sensitive information from server responses","analyst_note":"Find IBM's security bulletin for CVE-2026-17231 to confirm the fixed version and the specific response discrepancy and its preconditions.","how_to_check":"- Check the installed IBM API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for further detection steps; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where the API gateway or management components are reachable by remote clients. The sources do not describe the exact response behavior or required configuration, so exposure beyond the version range is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000715,"input_tokens":4224,"output_tokens":586,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17231':15A,18A '-2026':14A,17A '10.0.8.0':34B,64C '10.0.8.12':36B,66C '12.1.0.0':38B,68C '12.1.1.2':40B,70C 'allow':72C 'api':2A,20B,24B,31B,62C 'api-gateway':19B 'attack':9A,52B,75C 'connect':3A,25B,32B,63C 'could':71C 'cve':13A,16A 'data':60B 'differ':46B,56B 'discrep':5A,85C 'due':80C 'gateway':21B 'host':29B 'ibm':1A,23B,30B,61C 'ibm-api-connect':22B 'inform':12A,42B,79C 'infrastructur':26B 'leak':41B 'let':6A 'observ':45B,83C 'obtain':10A,58B,77C 'remot':8A,51B,74C 'respons':4A,49B,84C 'self':28B 'self-host':27B 'sensit':11A,59B,78C 'server':48B 'use':54B 'version':33B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges, where the API gateway or management components are reachable by remote clients. The sources do not describe the exact response behavior or required configuration, so exposure beyond the version range is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-17231':15A,18A '-2026':14A,17A 'api':2A 'attack':9A 'connect':3A 'cve':13A,16A 'discrep':5A 'ibm':1A 'inform':12A 'let':6A 'obtain':10A 'remot':8A 'respons':4A 'sensit':11A","search_b":"'10.0.8.0':34B '10.0.8.12':36B '12.1.0.0':38B '12.1.1.2':40B 'api':20B,24B,31B 'api-gateway':19B 'attack':52B 'connect':25B,32B 'data':60B 'differ':46B,56B 'gateway':21B 'host':29B 'ibm':23B,30B 'ibm-api-connect':22B 'inform':42B 'infrastructur':26B 'leak':41B 'observ':45B 'obtain':58B 'remot':51B 'respons':49B 'self':28B 'self-host':27B 'sensit':59B 'server':48B 'use':54B 'version':33B","search_c":"'10.0.8.0':64C '10.0.8.12':66C '12.1.0.0':68C '12.1.1.2':70C 'allow':72C 'api':62C 'attack':75C 'connect':63C 'could':71C 'discrep':85C 'due':80C 'ibm':61C 'inform':79C 'observ':83C 'obtain':77C 'remot':74C 'respons':84C 'sensit':78C","first_public_at":"2026-11-07T05:18:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17231","severity":null,"published_at":"2026-11-07T05:18:31+00:00","modified_at":"2026-11-07T05:18:31+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","fetched_at":"2026-11-07T05:46:00+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}