{"id":"CVE-2026-17232","kind":"vulnerability","aliases":["CVE-2026-17232"],"related":[],"title":"IBM API Connect: crafted requests can bypass security restrictions","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper neutralization of special elements in a request. Specially formed request parameters are not handled safely, which could allow protections to be circumvented.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 mishandle special characters in request parameters. A remote attacker can send specially formed requests to get around security protections.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","runtime"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed API Connect version against the affected ranges `10.0.8.0` to `10.0.8.12` and `12.1.0.0` to `12.1.1.2`","fix":null,"status":"open","published_at":"2026-11-07T05:18:31+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","triaged_at":"2026-11-07T05:52:48+00:00","updated_at":"2026-11-07T05:52:48+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-07T05:52:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: crafted requests can bypass security restrictions","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 mishandle special characters in request parameters. A remote attacker can send specially formed requests to get around security protections.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker bypasses security restrictions on API requests","analyst_note":"Check the IBM security bulletin for CVE-2026-17232 for the fixed versions and any required configuration; the NVD entry alone gives no fix.","how_to_check":"- Check the installed API Connect version against the affected ranges `10.0.8.0` to `10.0.8.12` and `12.1.0.0` to `12.1.1.2`\n- unknown for further checks, the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges that expose API gateway endpoints to remote clients. Deployments outside those version ranges are not affected by this entry. The sources do not describe which configurations are most exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000691,"input_tokens":4257,"output_tokens":530,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17232':12A,15A '-2026':11A,14A '10.0.8.0':28B,57C '10.0.8.12':30B,59C '12.1.0.0':32B,61C '12.1.1.2':34B,63C 'allow':65C,93C 'api':2A,17B,21B,25B,55C 'api-gateway':16B 'around':51B 'attack':43B,68C 'bypass':7A,70C 'charact':37B 'circumv':97C 'connect':3A,22B,26B,56C 'could':64C,92C 'craft':4A 'cve':10A,13A 'due':73C 'element':79C 'form':47B,84C 'gateway':18B 'get':50B 'handl':89C 'ibm':1A,20B,24B,54C 'ibm-api-connect':19B 'improp':75C 'mishandl':35B 'neutral':76C 'paramet':40B,86C 'protect':53B,94C 'remot':42B,67C 'request':5A,39B,48B,82C,85C 'restrict':9A,72C 'runtim':23B 'safe':90C 'secur':8A,52B,71C 'send':45B 'special':36B,46B,78C,83C 'version':27B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges that expose API gateway endpoints to remote clients. Deployments outside those version ranges are not affected by this entry. The sources do not describe which configurations are most exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","medium","runtime"],"campaign_type":null,"search_a":"'-17232':12A,15A '-2026':11A,14A 'api':2A 'bypass':7A 'connect':3A 'craft':4A 'cve':10A,13A 'ibm':1A 'request':5A 'restrict':9A 'secur':8A","search_b":"'10.0.8.0':28B '10.0.8.12':30B '12.1.0.0':32B '12.1.1.2':34B 'api':17B,21B,25B 'api-gateway':16B 'around':51B 'attack':43B 'charact':37B 'connect':22B,26B 'form':47B 'gateway':18B 'get':50B 'ibm':20B,24B 'ibm-api-connect':19B 'mishandl':35B 'paramet':40B 'protect':53B 'remot':42B 'request':39B,48B 'runtim':23B 'secur':52B 'send':45B 'special':36B,46B 'version':27B","search_c":"'10.0.8.0':57C '10.0.8.12':59C '12.1.0.0':61C '12.1.1.2':63C 'allow':65C,93C 'api':55C 'attack':68C 'bypass':70C 'circumv':97C 'connect':56C 'could':64C,92C 'due':73C 'element':79C 'form':84C 'handl':89C 'ibm':54C 'improp':75C 'neutral':76C 'paramet':86C 'protect':94C 'remot':67C 'request':82C,85C 'restrict':72C 'safe':90C 'secur':71C 'special':78C,83C","first_public_at":"2026-11-07T05:18:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17232","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17232","severity":null,"published_at":"2026-11-07T05:18:31+00:00","modified_at":"2026-11-07T05:18:31+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","fetched_at":"2026-11-07T05:46:00+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}