{"id":"CVE-2026-17301","kind":"vulnerability","aliases":["CVE-2026-17301"],"related":[],"title":"IBM API Connect: unauthenticated attacker can bypass authentication via signature flaw","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not properly verify a cryptographic signature. An unauthenticated attacker can use this to bypass authentication.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"api-connect-v12-onprem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["versions-outside-affected-ranges"],"how_to_check":"Check your API Connect version. Affected: 10.0.8.0 through 10.0.8.12, and 12.1.0.0 through 12.1.1.2 (V12 OnPrem). Fixed: 10.0.8.13 and 12.1.1.3. IBM lists no workaround.","fix":"Upgrade API Connect 10.0.8.x to 10.0.8.13, or 12.1.x to 12.1.1.3. IBM lists no workarounds or interim fixes.","status":"open","published_at":"2026-11-07T05:18:37+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","triaged_at":"2026-11-07T05:48:23+00:00","updated_at":"2026-11-07T05:56:22+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:48:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: unauthenticated attacker can bypass authentication via signature flaw","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not properly verify a cryptographic signature. An unauthenticated attacker can use this to bypass authentication.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker bypasses authentication and reaches protected API management functions","analyst_note":"Confirm the fixed versions and any interim settings from IBM's security bulletin for CVE-2026-17301; the NVD entry alone gives only the affected ranges.","how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks: the sources do not say which endpoints or configurations are exposed.","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-affected-ranges"],"who_is_affected":"Organisations running IBM API Connect in the affected version ranges, where the API gateway or management components are reachable by an attacker. The sources do not say which deployment configurations are exposed, so teams should treat any internet-reachable instance in these ranges as at risk. Teams on versions outside the listed ranges are not affected by this description.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000727,"input_tokens":4231,"output_tokens":607,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and any interim settings from IBM's security bulletin for CVE-2026-17301; the NVD entry alone gives only the affected ranges.","search":"'-17301':14A,17A '-2026':13A,16A '10.0.8.0':41B,67C '10.0.8.12':43B,69C '12.1.0.0':45B,71C '12.1.1.2':47B,73C 'allow':75C 'api':2A,19A,22A,27B,31B,38B,65C 'api-connect':18A 'api-connect-v12-onprem':21A 'api-gateway':26B 'attack':5A,57B,78C 'authent':8A,63B,81C 'bypass':7A,62B,80C 'connect':3A,20A,23A,32B,39B,66C 'could':74C 'cryptograph':53B,88C 'cve':12A,15A 'due':82C 'flaw':11A 'gateway':28B 'host':36B 'ibm':1A,30B,37B,64C 'ibm-api-connect':29B 'improp':84C 'infrastructur':33B 'onprem':25A 'proper':50B 'self':35B 'self-host':34B 'signatur':10A,54B,89C 'unauthent':4A,56B,77C 'use':59B 'v12':24A 'verif':85C 'verifi':51B 'version':40B 'via':9A","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM API Connect 10.0.8.0 to 10.0.8.12 or V12 OnPrem 12.1.0.0 to 12.1.1.2. An unauthenticated network attacker can bypass authentication because a cryptographic signature is not properly verified; IBM gives no further detail on which components or configurations are reached, so treat any reachable instance as exposed. Versions at 10.0.8.13 or 12.1.1.3 and later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:56:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1980},"products":{"at":"2026-11-07T05:56:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1980},"how_to_check":{"at":"2026-11-07T05:56:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1980},"who_affected":{"at":"2026-11-07T05:56:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1980}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","critical","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17301':14A,17A '-2026':13A,16A 'api':2A,19A,22A 'api-connect':18A 'api-connect-v12-onprem':21A 'attack':5A 'authent':8A 'bypass':7A 'connect':3A,20A,23A 'cve':12A,15A 'flaw':11A 'ibm':1A 'onprem':25A 'signatur':10A 'unauthent':4A 'v12':24A 'via':9A","search_b":"'10.0.8.0':41B '10.0.8.12':43B '12.1.0.0':45B '12.1.1.2':47B 'api':27B,31B,38B 'api-gateway':26B 'attack':57B 'authent':63B 'bypass':62B 'connect':32B,39B 'cryptograph':53B 'gateway':28B 'host':36B 'ibm':30B,37B 'ibm-api-connect':29B 'infrastructur':33B 'proper':50B 'self':35B 'self-host':34B 'signatur':54B 'unauthent':56B 'use':59B 'verifi':51B 'version':40B","search_c":"'10.0.8.0':67C '10.0.8.12':69C '12.1.0.0':71C '12.1.1.2':73C 'allow':75C 'api':65C 'attack':78C 'authent':81C 'bypass':80C 'connect':66C 'could':74C 'cryptograph':88C 'due':82C 'ibm':64C 'improp':84C 'signatur':89C 'unauthent':77C 'verif':85C","first_public_at":"2026-11-07T05:18:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17301","severity":null,"published_at":"2026-11-07T05:18:37+00:00","modified_at":"2026-11-07T05:18:38+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","fetched_at":"2026-11-07T05:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17301:1980","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T05:56:22+00:00","modified_at":"2026-11-07T05:56:22+00:00","first_seen_at":"2026-11-07T05:56:22+00:00","fetched_at":"2026-11-07T05:56:22+00:00","note":"Read IBM bulletins -41 (10.0.8.x, fix 10.0.8.13) and -39 (12.1.x, fix 12.1.1.3); both list CVE-2026-17301, CWE-347, CVSS 9.8, no workarounds, no interim fixes. Bulletin metadata ranges differ by one version from tables; used tables. No exploitation/PoC seen (didn't search social).","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}