{"id":"CVE-2026-17278","kind":"vulnerability","aliases":["CVE-2026-17278"],"related":[],"title":"IBM API Connect 12.1.0.0-12.1.1.2: remote caller can pass as a trusted party and read API catalog and runtime configuration data","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to appear as a trusted party.","summary":"IBM says API Connect V12 OnPrem v12.1.0.0 through v12.1.1.2 does not sufficiently verify client-supplied information, so a remote unauthenticated caller can appear as a trusted party and read sensitive API catalog and runtime configuration data. Fixed in v12.1.1.3; IBM lists no workaround.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","authentication-bypass","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"Check your API Connect V12 OnPrem version. Versions v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 contains the fix. The 10.0.8.x line is not listed for this CVE in IBM's bulletin.","fix":"Upgrade IBM API Connect to v12.1.1.3 (Fix Central, see IBM node 7290205). IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:33+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","triaged_at":"2026-11-07T05:48:30+00:00","updated_at":"2026-11-07T05:58:26+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: flaw exposes API catalog and runtime configuration data","impact":"high","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 fail to properly authenticate callers, because client-supplied information is not sufficiently verified. A remote attacker can pose as a trusted party and read sensitive API catalog and runtime configuration data.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker reads sensitive API catalog and runtime configuration data","analyst_note":"Find IBM's security bulletin for CVE-2026-17278 to confirm the fixed version and any required setting; the NVD entry gives no fix or configuration detail.","how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 are exposed, since the flaw lies in how the platform authenticates callers over the network. The sources do not say which deployment modes or configurations are vulnerable, so teams should confirm their version and whether the management or runtime endpoints are reachable from outside.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00071,"input_tokens":4243,"output_tokens":572,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17278 to confirm the fixed version and any required setting; the NVD entry gives no fix or configuration detail.","search":"'-17278':24A,27A '-2026':23A,26A '12.1.0.0':4A,93C '12.1.1.2':5A,95C 'access':104C 'allow':97C,128C 'api':2A,16A,28A,33B,40B,48B,77B,91C,107C 'api-gateway':32B 'appear':69B,132C 'attack':100C 'authent':36B,116C 'authentication-bypass':35B 'bypass':37B 'caller':7A,67B,130C 'catalog':17A,78B,108C 'client':60B,121C 'client-suppli':59B 'configur':20A,81B,111C 'connect':3A,29A,41B,49B,92C 'could':96C,127C 'cve':22A,25A 'data':21A,82B,112C 'due':113C 'fix':83B 'gain':102C 'gateway':34B 'host':44B 'ibm':1A,39B,46B,86B,90C 'ibm-api-connect':38B 'improp':115C 'inform':62B,117C 'list':87B 'onprem':31A,51B 'parti':13A,73B,136C 'pass':9A 'read':15A,75B 'remot':6A,65B,99C 'runtim':19A,80B,110C 'say':47B 'self':43B 'self-host':42B 'sensit':76B,106C 'suffici':57B,124C 'suppli':61B,118C 'trust':12A,72B,135C 'unauthent':66B 'unauthor':103C 'v12':30A,50B 'v12.1.0.0':52B 'v12.1.1.2':54B 'v12.1.1.3':85B 'vendor':45B 'verifi':58B,125C 'workaround':89B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted IBM API Connect V12 OnPrem deployments on v12.1.0.0 through v12.1.1.2 are exposed; IBM rates it 9.8 with network access and no privileges needed. Teams on 10.0.8.x are not listed for this CVE in the bulletin. Upgrade to v12.1.1.3.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:58:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":1986},"products":{"at":"2026-11-07T05:58:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":1986},"workarounds":{"at":"2026-11-07T05:58:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":1986},"how_to_check":{"at":"2026-11-07T05:58:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":1986},"who_affected":{"at":"2026-11-07T05:58:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":1986}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authenticationbypass","critical","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17278':24A,27A '-2026':23A,26A '12.1.0.0':4A '12.1.1.2':5A 'api':2A,16A,28A 'caller':7A 'catalog':17A 'configur':20A 'connect':3A,29A 'cve':22A,25A 'data':21A 'ibm':1A 'onprem':31A 'parti':13A 'pass':9A 'read':15A 'remot':6A 'runtim':19A 'trust':12A 'v12':30A","search_b":"'api':33B,40B,48B,77B 'api-gateway':32B 'appear':69B 'authent':36B 'authentication-bypass':35B 'bypass':37B 'caller':67B 'catalog':78B 'client':60B 'client-suppli':59B 'configur':81B 'connect':41B,49B 'data':82B 'fix':83B 'gateway':34B 'host':44B 'ibm':39B,46B,86B 'ibm-api-connect':38B 'inform':62B 'list':87B 'onprem':51B 'parti':73B 'read':75B 'remot':65B 'runtim':80B 'say':47B 'self':43B 'self-host':42B 'sensit':76B 'suffici':57B 'suppli':61B 'trust':72B 'unauthent':66B 'v12':50B 'v12.1.0.0':52B 'v12.1.1.2':54B 'v12.1.1.3':85B 'vendor':45B 'verifi':58B 'workaround':89B","search_c":"'12.1.0.0':93C '12.1.1.2':95C 'access':104C 'allow':97C,128C 'api':91C,107C 'appear':132C 'attack':100C 'authent':116C 'caller':130C 'catalog':108C 'client':121C 'configur':111C 'connect':92C 'could':96C,127C 'data':112C 'due':113C 'gain':102C 'ibm':90C 'improp':115C 'inform':117C 'parti':136C 'remot':99C 'runtim':110C 'sensit':106C 'suffici':124C 'suppli':118C 'trust':135C 'unauthor':103C 'verifi':125C","first_public_at":"2026-11-07T05:18:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17278","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17278","severity":null,"published_at":"2026-11-07T05:18:33+00:00","modified_at":"2026-11-07T05:18:33+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","fetched_at":"2026-11-07T05:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17278:1986","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T05:58:26+00:00","modified_at":"2026-11-07T05:58:26+00:00","first_seen_at":"2026-11-07T05:58:26+00:00","fetched_at":"2026-11-07T05:58:26+00:00","note":"IBM bulletin (api-connect-39) lists CVE-2026-17278 (CWE-290, IBM CVSS 9.8, AV:N/PR:N): affected API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fix v12.1.1.3, workarounds none. Exploitation/PoC and social chatter not checked.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/node/7290205"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93155,"url":"https://www.ibm.com/support/pages/node/7290205","title":"IBM API Connect v12.1.1.3 is now available","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}