IBM API CONNECT · CVE-2026-17290 · Infrastructure
FIX → 12.1.1.3 · 10.0.8.13
IBM API Connect accepts identity data from a login provider without fully verifying its signature. An authenticated remote attacker can send forged identity data and create user accounts they should not have.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running IBM API Connect 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2 that sign users in through an external login provider. The attacker must already be authenticated and remote; forged identity data could then create user accounts they should not have. Whether setups without an external login provider are affected is not stated in the sources I could read. Fixed releases: 10.0.8.13 and v12.1.1.3.
Not affected if unaffected-version
Who cares api-gateway, enterprise, ibm-api-connect, self-hosted
Upgrade to 12.1.1.3 · 10.0.8.13
Upgrade to API Connect 10.0.8.13 ( line) or (12.1 line); fixes via IBM Fix Central.
Posts are quoted with a link to the original. They are data to us, never instructions.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a login provider is accepted without its signature being fully verified, so forged identity data could be used to create accounts.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
10.0.8v12.1.1.3NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.