{"id":"CVE-2026-17240","kind":"vulnerability","aliases":["CVE-2026-17240"],"related":[],"title":"IBM API Connect: improper authentication lets remote attackers reach protected resources","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper authentication. Authentication checks are not applied consistently, which could allow protected resources to be reached without valid credentials.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 apply authentication checks inconsistently. A remote attacker can reach protected resources without valid credentials.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["versions-outside-range"],"how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2","fix":null,"status":"open","published_at":"2026-11-07T05:18:32+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","triaged_at":"2026-11-07T05:52:31+00:00","updated_at":"2026-11-07T05:52:31+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-07T05:52:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: improper authentication lets remote attackers reach protected resources","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 apply authentication checks inconsistently. A remote attacker can reach protected resources without valid credentials.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"remote attacker reaches protected API resources without credentials","analyst_note":"Check the IBM security bulletin for CVE-2026-17240 for the fixed versions and the affected endpoints; the NVD entry gives only the description.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks: the sources do not say which endpoints or settings are involved","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-range"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where protected API resources are exposed to remote clients. The sources do not say which endpoints or configurations are involved, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4253,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17240':14A,17A '-2026':13A,16A '10.0.8.0':33B,57C '10.0.8.12':35B,59C '12.1.0.0':37B,61C '12.1.1.2':39B,63C 'allow':65C,85C 'api':2A,19B,23B,30B,55C 'api-gateway':18B 'appli':40B,81C 'attack':8A,46B,68C 'authent':5A,41B,76C,77C 'bypass':70C 'check':42B,78C 'connect':3A,24B,31B,56C 'consist':82C 'could':64C,84C 'credenti':53B,93C 'cve':12A,15A 'due':73C 'gateway':20B 'host':27B 'ibm':1A,22B,29B,54C 'ibm-api-connect':21B 'improp':4A,75C 'inconsist':43B 'let':6A 'protect':10A,49B,86C 'reach':9A,48B,90C 'remot':7A,45B,67C 'resourc':11A,50B,87C 'restrict':72C 'secur':71C 'self':26B 'self-host':25B 'valid':52B,92C 'vendor':28B 'version':32B 'without':51B,91C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges, where protected API resources are exposed to remote clients. The sources do not say which endpoints or configurations are involved, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17240':14A,17A '-2026':13A,16A 'api':2A 'attack':8A 'authent':5A 'connect':3A 'cve':12A,15A 'ibm':1A 'improp':4A 'let':6A 'protect':10A 'reach':9A 'remot':7A 'resourc':11A","search_b":"'10.0.8.0':33B '10.0.8.12':35B '12.1.0.0':37B '12.1.1.2':39B 'api':19B,23B,30B 'api-gateway':18B 'appli':40B 'attack':46B 'authent':41B 'check':42B 'connect':24B,31B 'credenti':53B 'gateway':20B 'host':27B 'ibm':22B,29B 'ibm-api-connect':21B 'inconsist':43B 'protect':49B 'reach':48B 'remot':45B 'resourc':50B 'self':26B 'self-host':25B 'valid':52B 'vendor':28B 'version':32B 'without':51B","search_c":"'10.0.8.0':57C '10.0.8.12':59C '12.1.0.0':61C '12.1.1.2':63C 'allow':65C,85C 'api':55C 'appli':81C 'attack':68C 'authent':76C,77C 'bypass':70C 'check':78C 'connect':56C 'consist':82C 'could':64C,84C 'credenti':93C 'due':73C 'ibm':54C 'improp':75C 'protect':86C 'reach':90C 'remot':67C 'resourc':87C 'restrict':72C 'secur':71C 'valid':92C 'without':91C","first_public_at":"2026-11-07T05:18:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17240","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17240","severity":null,"published_at":"2026-11-07T05:18:32+00:00","modified_at":"2026-11-07T05:18:32+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","fetched_at":"2026-11-07T05:46:01+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}