{"id":"CVE-2026-17304","kind":"vulnerability","aliases":["CVE-2026-17304"],"related":[],"title":"IBM API Connect: import validation flaw lets attackers read server-side content","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Locations supplied when service definitions are imported are not sufficiently validated, which could allow the server to retrieve content it should not access.","summary":"IBM API Connect 12.1.0.0 through 12.1.1.2 does not validate locations supplied when service definitions are imported. An authenticated remote attacker can make the server fetch content it should not access, which exposes sensitive information.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["auth-required","version-outside-range"],"how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`","fix":"- Move IBM API Connect past `12.1.1.2`; the sources do not name the fixed version","status":"open","published_at":"2026-11-07T05:18:38+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","triaged_at":"2026-11-07T05:52:40+00:00","updated_at":"2026-11-07T05:52:40+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:52:40Z","model":"claude-haiku-5-5","output":{"fix":"- Move IBM API Connect past `12.1.1.2`; the sources do not name the fixed version\n- unknown for the exact fixed release","reach":"network","title":"IBM API Connect: import validation flaw lets attackers read server-side content","impact":"medium","summary":"IBM API Connect 12.1.0.0 through 12.1.1.2 does not validate locations supplied when service definitions are imported. An authenticated remote attacker can make the server fetch content it should not access, which exposes sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Server fetches and returns internal content, exposing sensitive information","analyst_note":"Find the IBM security bulletin for CVE-2026-17304 to confirm the fixed version and any interim fix.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","version-outside-range"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where users can import service definitions. The flaw needs an authenticated account able to import definitions, so teams that restrict imports to trusted administrators have less exposure. unknown for further detail.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4233,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17304':16A,19A '-2026':15A,18A '12.1.0.0':34B,68C '12.1.1.2':36B,70C 'access':60B,108C 'allow':72C,99C 'api':2A,21B,25B,32B,66C 'api-gateway':20B 'attack':8A,50B,76C 'authent':48B,75C 'connect':3A,26B,33B,67C 'content':13A,56B,104C 'could':71C,98C 'cve':14A,17A 'definit':44B,90C 'due':81C 'expos':62B 'fetch':55B 'flaw':6A 'gateway':22B 'host':29B 'ibm':1A,24B,31B,65C 'ibm-api-connect':23B 'import':4A,46B,92C 'improp':83C 'inform':64B,80C 'input':84C 'let':7A 'locat':40B,86C 'make':52B 'obtain':78C 'read':9A 'remot':49B,74C 'retriev':103C 'self':28B 'self-host':27B 'sensit':63B,79C 'server':11A,54B,101C 'server-sid':10A 'servic':43B,89C 'side':12A 'suffici':95C 'suppli':41B,87C 'valid':5A,39B,85C,96C 'vendor':30B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where users can import service definitions. The flaw needs an authenticated account able to import definitions, so teams that restrict imports to trusted administrators have less exposure. unknown for further detail.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17304':16A,19A '-2026':15A,18A 'api':2A 'attack':8A 'connect':3A 'content':13A 'cve':14A,17A 'flaw':6A 'ibm':1A 'import':4A 'let':7A 'read':9A 'server':11A 'server-sid':10A 'side':12A 'valid':5A","search_b":"'12.1.0.0':34B '12.1.1.2':36B 'access':60B 'api':21B,25B,32B 'api-gateway':20B 'attack':50B 'authent':48B 'connect':26B,33B 'content':56B 'definit':44B 'expos':62B 'fetch':55B 'gateway':22B 'host':29B 'ibm':24B,31B 'ibm-api-connect':23B 'import':46B 'inform':64B 'locat':40B 'make':52B 'remot':49B 'self':28B 'self-host':27B 'sensit':63B 'server':54B 'servic':43B 'suppli':41B 'valid':39B 'vendor':30B","search_c":"'12.1.0.0':68C '12.1.1.2':70C 'access':108C 'allow':72C,99C 'api':66C 'attack':76C 'authent':75C 'connect':67C 'content':104C 'could':71C,98C 'definit':90C 'due':81C 'ibm':65C 'import':92C 'improp':83C 'inform':80C 'input':84C 'locat':86C 'obtain':78C 'remot':74C 'retriev':103C 'sensit':79C 'server':101C 'servic':89C 'suffici':95C 'suppli':87C 'valid':85C,96C","first_public_at":"2026-11-07T05:18:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17304","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17304","severity":null,"published_at":"2026-11-07T05:18:38+00:00","modified_at":"2026-11-07T05:18:38+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","fetched_at":"2026-11-07T05:46:02+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}