---
id: "CVE-2026-17304"
page: "https://infrastack.ai/live/CVE-2026-17304"
kind: "vulnerability"
aliases: ["CVE-2026-17304"]
title: "IBM API Connect: import validation flaw lets attackers read server-side content"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["api-gateway", "ibm-api-connect", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "version-outside-range"]
published_at: "2026-11-07T05:18:38+00:00"
first_seen_at: "2026-11-07T05:46:02+00:00"
updated_at: "2026-11-07T05:52:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17304", "first_seen_at": "2026-11-07T05:46:02+00:00"}]
exploit_sources: []
---

# IBM API Connect: import validation flaw lets attackers read server-side content

Link for people: https://infrastack.ai/live/CVE-2026-17304 (this .md is for agents)

IBM API Connect 12.1.0.0 through 12.1.1.2 does not validate locations supplied when service definitions are imported. An authenticated remote attacker can make the server fetch content it should not access, which exposes sensitive information.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`

## Fix

- Move IBM API Connect past `12.1.1.2`; the sources do not name the fixed version

## Timeline

- 2026-11-07T05:46:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17304

## From the sources

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Locations supplied when service definitions are imported are not sufficiently validated, which could allow the server to retrieve content it should not access.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_