{"id":"CVE-2026-17284","kind":"vulnerability","aliases":["CVE-2026-17284"],"related":[],"title":"IBM API Connect: authenticated users can act in other tenants' environments","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information. Tenant context is not sufficiently verified, which could allow actions on resources belonging to other tenants.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not properly validate client-supplied tenant context. A logged-in attacker can perform operations on resources belonging to other tenants.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13","12.1.1.3"],"affected":">= 10.0.8.0, <= 10.0.8.12; >= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-management","ibm-api-connect","infrastructure","multi-tenant","self-hosted"],"not_affected_if":["single-tenant-deployment","versions-outside-range"],"how_to_check":"Check the API Connect version: affected are 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. Only matters if more than one tenant/org shares the deployment and non-fully-trusted users can log in.","fix":"Upgrade IBM API Connect 10.0.8.x to 10.0.8.13, or 12.1.x to 12.1.1.3 (per IBM's CVE record; fix packs on IBM Fix Central).","status":"open","published_at":"2026-11-07T05:18:34+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","triaged_at":"2026-11-07T05:52:20+00:00","updated_at":"2026-11-07T06:22:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:52:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can act in other tenants' environments","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not properly validate client-supplied tenant context. A logged-in attacker can perform operations on resources belonging to other tenants.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","multi-tenant","api-management"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker acts on other tenants' API resources","analyst_note":"Find IBM's security bulletin for CVE-2026-17284 to confirm the fixed versions and any mitigation; the NVD entry gives no fix.","how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- Confirm whether the deployment is multi-tenant and which accounts can log in to it.","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-range","single-tenant-deployment"],"who_is_affected":"Organisations running IBM API Connect in the affected version ranges, especially multi-tenant deployments where several tenants share one installation. The attacker needs a valid account on the platform. Single-tenant installations on other versions are not in the stated ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4271,"output_tokens":576,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17284 to confirm the fixed versions and any mitigation; the NVD entry gives no fix.","search":"'-17284':14A,17A '-2026':13A,16A '10.0.8.0':39B,72C '10.0.8.12':41B,74C '12.1.0.0':43B,76C '12.1.1.2':45B,78C 'act':7A 'action':111C 'allow':80C,110C 'api':2A,19A,22B,26B,36B,70C 'api-manag':21B 'attack':59B,84C 'authent':4A,83C 'belong':65B,114C 'client':51B,99C 'client-suppli':50B,98C 'connect':3A,20A,27B,37B,71C 'context':54B,103C 'could':79C,109C 'cve':12A,15A 'due':93C 'environ':11A,92C 'host':34B 'ibm':1A,18A,25B,35B,69C 'ibm-api-connect':24B 'improp':95C 'inform':101C 'infrastructur':28B 'log':57B 'logged-in':56B 'manag':23B 'multi':30B 'multi-ten':29B 'oper':62B,88C 'perform':61B,86C 'proper':48B 'remot':82C 'resourc':64B,113C 'self':33B 'self-host':32B 'suffici':106C 'suppli':52B,100C 'tenant':10A,31B,53B,68B,91C,102C,117C 'unauthor':87C 'user':5A 'valid':49B,96C 'verifi':107C 'version':38B","nicknames":[],"mitigations":[],"who_affected":"Self-managed IBM API Connect 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 where several tenants or organizations share one deployment. Any logged-in user could act on other tenants' resources because the tenant context sent by the client is not verified. Single-tenant deployments with only trusted users are lower risk; patched versions are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apiconnect","ibmapiconnect"],"ptokens":["api","connect","ibm"],"labels":["apimanagement","high","ibmapiconnect","infrastructure","multitenant","selfhosted"],"campaign_type":null,"search_a":"'-17284':14A,17A '-2026':13A,16A 'act':7A 'api':2A,19A 'authent':4A 'connect':3A,20A 'cve':12A,15A 'environ':11A 'ibm':1A,18A 'tenant':10A 'user':5A","search_b":"'10.0.8.0':39B '10.0.8.12':41B '12.1.0.0':43B '12.1.1.2':45B 'api':22B,26B,36B 'api-manag':21B 'attack':59B 'belong':65B 'client':51B 'client-suppli':50B 'connect':27B,37B 'context':54B 'host':34B 'ibm':25B,35B 'ibm-api-connect':24B 'infrastructur':28B 'log':57B 'logged-in':56B 'manag':23B 'multi':30B 'multi-ten':29B 'oper':62B 'perform':61B 'proper':48B 'resourc':64B 'self':33B 'self-host':32B 'suppli':52B 'tenant':31B,53B,68B 'valid':49B 'version':38B","search_c":"'10.0.8.0':72C '10.0.8.12':74C '12.1.0.0':76C '12.1.1.2':78C 'action':111C 'allow':80C,110C 'api':70C 'attack':84C 'authent':83C 'belong':114C 'client':99C 'client-suppli':98C 'connect':71C 'context':103C 'could':79C,109C 'due':93C 'environ':92C 'ibm':69C 'improp':95C 'inform':101C 'oper':88C 'perform':86C 'remot':82C 'resourc':113C 'suffici':106C 'suppli':100C 'tenant':91C,102C,117C 'unauthor':87C 'valid':96C 'verifi':107C","first_public_at":"2026-11-07T05:18:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17284","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17284","severity":null,"published_at":"2026-11-07T05:18:34+00:00","modified_at":"2026-11-07T05:18:34+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","fetched_at":"2026-11-07T05:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17284:2061","url":"https://app.opencve.io/cve/CVE-2026-17284","severity":null,"published_at":"2026-11-07T06:22:50+00:00","modified_at":"2026-11-07T06:22:50+00:00","first_seen_at":"2026-11-07T06:22:50+00:00","fetched_at":"2026-11-07T06:22:50+00:00","note":"Fix versions (10.0.8.13, 12.1.1.3) taken from the IBM CVE record vendor solution as shown on OpenCVE (a rewrite). The IBM 10.0.8.13 bulletin page I fetched was truncated and I could not see CVE-2026-17284 listed, so nothing is marked verified. No exploitation or PoC seen; no vendor mitigation found.","cites":["https://app.opencve.io/cve/CVE-2026-17284","https://www.ibm.com/support/pages/node/7295637"]}],"documents":[{"id":93479,"url":"https://app.opencve.io/cve/CVE-2026-17284","title":"CVE-2026-17284 - OpenCVE (carries IBM's CVE record and vendor solution)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":93164,"url":"https://www.ibm.com/support/pages/node/7295637","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}