---
id: "CVE-2026-17299"
page: "https://infrastack.ai/live/CVE-2026-17299"
kind: "vulnerability"
aliases: ["CVE-2026-17299"]
title: "IBM API Connect: remote authenticated users can read files and forge server requests"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "API Connect", "fixed": ["10.0.8.13"], "affected": ">= 10.0.8.0, <= 10.0.8.12", "ecosystem": "vendor"}, {"name": "API Connect V12 OnPrem", "fixed": ["12.1.1.3"], "affected": ">= 12.1.0.0, <= 12.1.1.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["api-gateway", "ibm-api-connect", "infrastructure", "self-hosted"]
not_affected_if: ["unaffected-version"]
published_at: "2026-11-07T05:18:37+00:00"
first_seen_at: "2026-11-07T05:46:02+00:00"
updated_at: "2026-11-07T05:56:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17299", "first_seen_at": "2026-11-07T05:46:02+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39", "first_seen_at": "2026-11-07T05:56:10+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39", "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41"]}]
exploit_sources: []
---

# IBM API Connect: remote authenticated users can read files and forge server requests

Link for people: https://infrastack.ai/live/CVE-2026-17299 (this .md is for agents)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 resolve external references in submitted API definitions without enough restriction. An authenticated attacker can make the server read arbitrary local files and send requests to internal systems, with the retrieved content returned to them.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:API Connect affected >= 10.0.8.0, <= 10.0.8.12 fixed 10.0.8.13
- vendor:API Connect V12 OnPrem affected >= 12.1.0.0, <= 12.1.1.2 fixed 12.1.1.3

## How to check

Check your installed API Connect version. You are affected on V10 at 10.0.8.0 through 10.0.8.12, and on V12 OnPrem at 12.1.0.0 through 12.1.1.2. Any user who can submit API definitions can trigger it, so also review who holds those rights.

## Fix

Upgrade API Connect V10 to 10.0.8.13, or V12 OnPrem to 12.1.1.3. IBM lists no workaround.

## Timeline

- 2026-11-07T05:46:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17299
- 2026-11-07T05:56:10+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39 — IBM bulletins list this CVE: v12.1.1.3 fixes V12 OnPrem (affected 12.1.0.0-12.1.1.2), 10.0.8.13 fixes V10 (affected 10.0.8.0-10.0.8.12). Both state workarounds: None. No exploitation or PoC seen; I did not search social posts.

## Documents

- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39
- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41

## From the sources

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file reads and server-side request forgery due to unrestricted resolution of external references. Externally referenced content in submitted definitions is not sufficiently restricted when processed, and the retrieved content could be returned to the attacker.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_