{"id":"CVE-2026-17295","kind":"vulnerability","aliases":["CVE-2026-17295"],"related":[],"title":"IBM API Connect 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2: authenticated user can read sensitive information via path traversal; fixed in 10.0.8.13 and 12.1.1.3","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.","summary":"IBM says API Connect could let a remote authenticated attacker obtain sensitive information through path traversal (CWE-22, CVSS 7.7, PR:L, scope changed). Fixed in 10.0.8.13 and v12.1.1.3. IBM lists no workarounds and states no exploitation.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","authenticated","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["auth-required","version-outside-range"],"how_to_check":"Check your API Connect version. Affected: 10.0.8.0 through 10.0.8.12, and V12 OnPrem 12.1.0.0 through 12.1.1.2. Fixed: 10.0.8.13 and 12.1.1.3. IBM does not name the vulnerable endpoint or files; exposure needs a valid account.","fix":"Upgrade to 10.0.8.13 (V10) or v12.1.1.3 (V12 OnPrem; Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:36+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","triaged_at":"2026-11-07T05:50:45+00:00","updated_at":"2026-11-07T06:20:52+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:50:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: path traversal lets a logged-in user read sensitive files","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal flaw. A remote attacker with a valid account can use it to obtain sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive files from the server","analyst_note":"Confirm the fixed version and any configuration preconditions from the IBM security bulletin for CVE-2026-17295; the NVD entry gives only the affected ranges.","how_to_check":"- Check the installed IBM API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running IBM API Connect in the affected version ranges, reachable over the network by an authenticated user. The sources do not say which configurations or roles are needed beyond authentication. Systems on versions outside the listed ranges are not in scope.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000696,"input_tokens":4222,"output_tokens":547,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any configuration preconditions from the IBM security bulletin for CVE-2026-17295; the NVD entry gives only the affected ranges.","search":"'-17295':25A,28A '-2026':24A,27A '-22':64B '10.0.8.0':4A,87C '10.0.8.12':5A,89C '10.0.8.13':20A,73B '12.1.0.0':7A,91C '12.1.1.2':8A,93C '12.1.1.3':22A '7.7':66B 'allow':95C 'api':2A,29A,31A,36B,41B,49B,85C 'api-gateway':35B 'attack':56B,99C 'authent':9A,38B,55B,98C 'chang':70B 'connect':3A,30A,32A,42B,50B,86C 'could':51B,94C 'cve':23A,26A 'cvss':65B 'cwe':63B 'due':104C 'exploit':83B 'fix':18A,71B 'gateway':37B 'host':46B 'ibm':1A,40B,47B,76B,84C 'ibm-api-connect':39B 'inform':14A,59B,103C 'infrastructur':43B 'l':68B 'let':52B 'list':77B 'obtain':57B,101C 'onprem':34A 'path':16A,61B,106C 'pr':67B 'read':12A 'remot':54B,97C 'say':48B 'scope':69B 'self':45B 'self-host':44B 'sensit':13A,58B,102C 'state':81B 'travers':17A,62B,107C 'user':10A 'v12':33A 'v12.1.1.3':75B 'via':15A 'workaround':79B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect in the affected version ranges, reachable over the network by an authenticated user. The sources do not say which configurations or roles are needed beyond authentication. Systems on versions outside the listed ranges are not in scope.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:20:52Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2053},"products":{"at":"2026-11-07T06:20:52Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2053},"workarounds":{"at":"2026-11-07T06:20:52Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2053},"how_to_check":{"at":"2026-11-07T06:20:52Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2053}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","connect","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authenticated","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17295':25A,28A '-2026':24A,27A '10.0.8.0':4A '10.0.8.12':5A '10.0.8.13':20A '12.1.0.0':7A '12.1.1.2':8A '12.1.1.3':22A 'api':2A,29A,31A 'authent':9A 'connect':3A,30A,32A 'cve':23A,26A 'fix':18A 'ibm':1A 'inform':14A 'onprem':34A 'path':16A 'read':12A 'sensit':13A 'travers':17A 'user':10A 'v12':33A 'via':15A","search_b":"'-22':64B '10.0.8.13':73B '7.7':66B 'api':36B,41B,49B 'api-gateway':35B 'attack':56B 'authent':38B,55B 'chang':70B 'connect':42B,50B 'could':51B 'cvss':65B 'cwe':63B 'exploit':83B 'fix':71B 'gateway':37B 'host':46B 'ibm':40B,47B,76B 'ibm-api-connect':39B 'inform':59B 'infrastructur':43B 'l':68B 'let':52B 'list':77B 'obtain':57B 'path':61B 'pr':67B 'remot':54B 'say':48B 'scope':69B 'self':45B 'self-host':44B 'sensit':58B 'state':81B 'travers':62B 'v12.1.1.3':75B 'workaround':79B","search_c":"'10.0.8.0':87C '10.0.8.12':89C '12.1.0.0':91C '12.1.1.2':93C 'allow':95C 'api':85C 'attack':99C 'authent':98C 'connect':86C 'could':94C 'due':104C 'ibm':84C 'inform':103C 'obtain':101C 'path':106C 'remot':97C 'sensit':102C 'travers':107C","first_public_at":"2026-11-07T05:18:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17295","severity":null,"published_at":"2026-11-07T05:18:36+00:00","modified_at":"2026-11-07T05:18:37+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","fetched_at":"2026-11-07T05:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17295:2053","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:20:52+00:00","modified_at":"2026-11-07T06:20:52+00:00","first_seen_at":"2026-11-07T06:20:52+00:00","fetched_at":"2026-11-07T06:20:52+00:00","note":"Read IBM bulletins -41 (V10, fixed 10.0.8.13) and -39 (V12 OnPrem, fixed v12.1.1.3); both list CVE-2026-17295 (CWE-22, CVSS 7.7, PR:L). Workarounds: None. IBM does not name the endpoint or files. No exploitation stated. X not checked.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}