{"id":"CVE-2026-17308","kind":"vulnerability","aliases":["CVE-2026-17308"],"related":[],"title":"IBM API Connect: improper certificate validation leaks credentials to remote attackers","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive credentials and manipulate tool responses due to improper certificate validation.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not validate certificates properly. A remote attacker can obtain sensitive credentials and manipulate tool responses.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":[],"how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`","fix":null,"status":"open","published_at":"2026-11-07T05:18:39+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","triaged_at":"2026-11-07T05:52:24+00:00","updated_at":"2026-11-07T05:52:24+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-07T05:52:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: improper certificate validation leaks credentials to remote attackers","impact":"high","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not validate certificates properly. A remote attacker can obtain sensitive credentials and manipulate tool responses.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker obtains sensitive credentials and manipulates tool responses","analyst_note":"Find IBM's security bulletin for CVE-2026-17308 to confirm the fixed version and the affected component and configuration.","how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running IBM API Connect 12.1.0.0 through 12.1.1.2 are in scope. The sources do not describe which deployment paths or configurations are exposed, so whether a given instance is reachable depends on details not provided here.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":4201,"output_tokens":482,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17308':14A,17A '-2026':13A,16A '12.1.0.0':30B,52C '12.1.1.2':32B,54C 'allow':56C 'api':2A,20B,27B,50C 'attack':11A,40B,59C 'certif':5A,36B,71C 'connect':3A,21B,28B,51C 'could':55C 'credenti':8A,44B,63C 'cve':12A,15A 'due':68C 'host':25B 'ibm':1A,19B,26B,49C 'ibm-api-connect':18B 'improp':4A,70C 'infrastructur':22B 'leak':7A 'manipul':46B,65C 'obtain':42B,61C 'proper':37B 'remot':10A,39B,58C 'respons':48B,67C 'self':24B 'self-host':23B 'sensit':43B,62C 'tool':47B,66C 'valid':6A,35B,72C 'version':29B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect 12.1.0.0 through 12.1.1.2 are in scope. The sources do not describe which deployment paths or configurations are exposed, so whether a given instance is reachable depends on details not provided here.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmapiconnect","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-17308':14A,17A '-2026':13A,16A 'api':2A 'attack':11A 'certif':5A 'connect':3A 'credenti':8A 'cve':12A,15A 'ibm':1A 'improp':4A 'leak':7A 'remot':10A 'valid':6A","search_b":"'12.1.0.0':30B '12.1.1.2':32B 'api':20B,27B 'attack':40B 'certif':36B 'connect':21B,28B 'credenti':44B 'host':25B 'ibm':19B,26B 'ibm-api-connect':18B 'infrastructur':22B 'manipul':46B 'obtain':42B 'proper':37B 'remot':39B 'respons':48B 'self':24B 'self-host':23B 'sensit':43B 'tool':47B 'valid':35B 'version':29B","search_c":"'12.1.0.0':52C '12.1.1.2':54C 'allow':56C 'api':50C 'attack':59C 'certif':71C 'connect':51C 'could':55C 'credenti':63C 'due':68C 'ibm':49C 'improp':70C 'manipul':65C 'obtain':61C 'remot':58C 'respons':67C 'sensit':62C 'tool':66C 'valid':72C","first_public_at":"2026-11-07T05:18:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17308","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17308","severity":null,"published_at":"2026-11-07T05:18:39+00:00","modified_at":"2026-11-07T05:18:39+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","fetched_at":"2026-11-07T05:46:02+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}