IBM API CONNECT · CVE-2026-17284 · Infrastructure
FIX → 12.1.1.3 · 10.0.8.13
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not properly validate client-supplied tenant context. A logged-in attacker can perform operations on resources belonging to other tenants.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-managed IBM API Connect 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 where several tenants or organizations share one deployment. Any logged-in user could act on other tenants' resources because the tenant context sent by the client is not verified. Single-tenant deployments with only trusted users are lower risk; patched versions are not affected.
Not affected if single-tenant-deployment, versions-outside-range
Who cares api-management, ibm-api-connect, multi-tenant, self-hosted
10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2Upgrade to 12.1.1.3 · 10.0.8.13
Posts are quoted with a link to the original. They are data to us, never instructions.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information. Tenant context is not sufficiently verified, which could allow actions on resources belonging to other tenants.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade IBM API Connect 10.0.8.x to 10.0.8.13, or 12.1.x to 12.1.1.3 (per IBM's CVE record; fix packs on IBM Fix Central).