{"id":"CVE-2026-17290","kind":"vulnerability","aliases":["CVE-2026-17290"],"related":[],"title":"IBM API Connect: forged login identity lets attacker create unauthorized accounts","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a login provider is accepted without its signature being fully verified, so forged identity data could be used to create accounts.","summary":"IBM API Connect accepts identity data from a login provider without fully verifying its signature. An authenticated remote attacker can send forged identity data and create user accounts they should not have.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13","12.1.1.3"],"affected":">= 10.0.8.0, <= 10.0.8.12; >= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","enterprise","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check your API Connect version: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected; 10.0.8.13 and 12.1.1.3 are the fixed releases.\n- Check whether you have an external login/identity provider configured (user registry or OAuth/OIDC/SAML); IBM's CVE text says identity data from a login provider is accepted without full signature verification. Unconfirmed whether other setups are affected.\n- Review user account lists for accounts created without an approved process.","fix":"Upgrade to API Connect 10.0.8.13 (10.0.8 line) or v12.1.1.3 (12.1 line); fixes via IBM Fix Central.","status":"open","published_at":"2026-11-07T05:18:35+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","triaged_at":"2026-11-07T05:50:12+00:00","updated_at":"2026-11-07T06:21:52+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-07T05:50:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: forged login identity lets attacker create unauthorized accounts","impact":"medium","summary":"IBM API Connect accepts identity data from a login provider without fully verifying its signature. An authenticated remote attacker can send forged identity data and create user accounts they should not have.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","enterprise"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker creates unauthorized user accounts on the platform","analyst_note":"Check the IBM security bulletin for CVE-2026-17290 for the fixed version and whether a login-provider configuration is required.","how_to_check":"- Check the installed API Connect version against the affected ranges `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2`\n- Review user account lists for accounts created without an approved process\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges that use an external login provider for identity. An attacker needs an authenticated remote session, so exposure depends on who can sign in. unknown whether other configurations are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":4271,"output_tokens":524,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for CVE-2026-17290 for the fixed version and whether a login-provider configuration is required.","search":"'-17290':14A,17A '-2026':13A,16A '10.0.8.0':64C '10.0.8.12':66C '12.1.0.0':68C '12.1.1.2':70C 'accept':36B,96C 'account':11A,60B,81C,112C 'allow':72C 'api':2A,19A,22B,27B,34B,62C 'api-gateway':21B 'attack':8A,51B,76C 'authent':49B,75C 'connect':3A,20A,28B,35B,63C 'could':71C,107C 'creat':9A,58B,78C,111C 'cryptograph':87C 'cve':12A,15A 'data':38B,56B,106C 'due':82C 'enterpris':24B 'forg':4A,54B,104C 'fulli':44B,101C 'gateway':23B 'host':32B 'ibm':1A,18A,26B,33B,61C 'ibm-api-connect':25B 'ident':6A,37B,55B,89C,105C 'improp':84C 'inform':90C 'infrastructur':29B 'let':7A 'login':5A,41B,93C 'provid':42B,94C 'remot':50B,74C 'self':31B 'self-host':30B 'send':53B 'signatur':47B,88C,99C 'unauthor':10A,79C 'use':109C 'user':59B,80C 'verif':85C 'verifi':45B,102C 'without':43B,97C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2 that sign users in through an external login provider. The attacker must already be authenticated and remote; forged identity data could then create user accounts they should not have. Whether setups without an external login provider are affected is not stated in the sources I could read. Fixed releases: 10.0.8.13 and v12.1.1.3.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","ibmapiconnect"],"ptokens":["api","connect","ibm"],"labels":["apigateway","enterprise","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17290':14A,17A '-2026':13A,16A 'account':11A 'api':2A,19A 'attack':8A 'connect':3A,20A 'creat':9A 'cve':12A,15A 'forg':4A 'ibm':1A,18A 'ident':6A 'let':7A 'login':5A 'unauthor':10A","search_b":"'accept':36B 'account':60B 'api':22B,27B,34B 'api-gateway':21B 'attack':51B 'authent':49B 'connect':28B,35B 'creat':58B 'data':38B,56B 'enterpris':24B 'forg':54B 'fulli':44B 'gateway':23B 'host':32B 'ibm':26B,33B 'ibm-api-connect':25B 'ident':37B,55B 'infrastructur':29B 'login':41B 'provid':42B 'remot':50B 'self':31B 'self-host':30B 'send':53B 'signatur':47B 'user':59B 'verifi':45B 'without':43B","search_c":"'10.0.8.0':64C '10.0.8.12':66C '12.1.0.0':68C '12.1.1.2':70C 'accept':96C 'account':81C,112C 'allow':72C 'api':62C 'attack':76C 'authent':75C 'connect':63C 'could':71C,107C 'creat':78C,111C 'cryptograph':87C 'data':106C 'due':82C 'forg':104C 'fulli':101C 'ibm':61C 'ident':89C,105C 'improp':84C 'inform':90C 'login':93C 'provid':94C 'remot':74C 'signatur':88C,99C 'unauthor':79C 'use':109C 'user':80C 'verif':85C 'verifi':102C 'without':97C","first_public_at":"2026-11-07T05:18:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17290","severity":null,"published_at":"2026-11-07T05:18:35+00:00","modified_at":"2026-11-07T05:18:36+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","fetched_at":"2026-11-07T05:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17290:2057","url":"https://www.ibm.com/support/pages/node/7295635","severity":null,"published_at":"2026-11-07T06:21:52+00:00","modified_at":"2026-11-07T06:21:52+00:00","first_seen_at":"2026-11-07T06:21:52+00:00","fetched_at":"2026-11-07T06:21:52+00:00","note":"Fixed versions come from the CVE record's IBM solution text (via OpenCVE) and from the IBM bulletins node/7295635 (v12.1.1.3) and node/7295637 (10.0.8.13), which the CVE references. The fetched bulletin text was truncated before CVE-2026-17290, so I did not see its entry and verified nothing. Whether a login-provider config is required is not confirmed beyond the CVE description. No exploitation or PoC found.","cites":["https://www.ibm.com/support/pages/node/7295635","https://www.ibm.com/support/pages/node/7295637","https://app.opencve.io/cve/CVE-2026-17290"]}],"documents":[{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93164,"url":"https://www.ibm.com/support/pages/node/7295637","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93473,"url":"https://app.opencve.io/cve/CVE-2026-17290","title":"OpenCVE: CVE-2026-17290 (CVE record incl. IBM solution text)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}