{"id":"CVE-2026-17310","kind":"vulnerability","aliases":["CVE-2026-17310"],"related":[],"title":"IBM API Connect: hard-coded cryptographic key leaks sensitive information remotely","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 ship with a hard-coded cryptographic key. A remote attacker can use that key to obtain sensitive information.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`","fix":null,"status":"open","published_at":"2026-11-07T05:18:39+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","triaged_at":"2026-11-07T05:52:27+00:00","updated_at":"2026-11-07T05:52:27+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:52:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: hard-coded cryptographic key leaks sensitive information remotely","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 ship with a hard-coded cryptographic key. A remote attacker can use that key to obtain sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker reads sensitive information using the hard-coded key","analyst_note":"Find the IBM security bulletin for CVE-2026-17310 to confirm the fixed version, affected endpoints and whether the key is per-install or global.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running IBM API Connect 12.1.0.0 through 12.1.1.2 are in scope. The sources do not say which deployment configurations or data paths are exposed, so check the IBM security bulletin for details.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00067,"input_tokens":4198,"output_tokens":501,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17310':15A,18A '-2026':14A,17A '12.1.0.0':31B,56C '12.1.1.2':33B,58C 'allow':60C 'api':2A,21B,28B,54C 'attack':44B,63C 'code':6A,39B,76C 'connect':3A,22B,29B,55C 'could':59C 'cryptograph':7A,40B,77C 'cve':13A,16A 'due':68C 'hard':5A,38B,75C 'hard-cod':4A,37B,74C 'host':26B 'ibm':1A,20B,27B,53C 'ibm-api-connect':19B 'inform':11A,52B,67C 'infrastructur':23B 'key':8A,41B,48B,78C 'leak':9A 'obtain':50B,65C 'remot':12A,43B,62C 'self':25B 'self-host':24B 'sensit':10A,51B,66C 'ship':34B 'use':46B,71C 'version':30B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect 12.1.0.0 through 12.1.1.2 are in scope. The sources do not say which deployment configurations or data paths are exposed, so check the IBM security bulletin for details.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmapiconnect","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-17310':15A,18A '-2026':14A,17A 'api':2A 'code':6A 'connect':3A 'cryptograph':7A 'cve':13A,16A 'hard':5A 'hard-cod':4A 'ibm':1A 'inform':11A 'key':8A 'leak':9A 'remot':12A 'sensit':10A","search_b":"'12.1.0.0':31B '12.1.1.2':33B 'api':21B,28B 'attack':44B 'code':39B 'connect':22B,29B 'cryptograph':40B 'hard':38B 'hard-cod':37B 'host':26B 'ibm':20B,27B 'ibm-api-connect':19B 'inform':52B 'infrastructur':23B 'key':41B,48B 'obtain':50B 'remot':43B 'self':25B 'self-host':24B 'sensit':51B 'ship':34B 'use':46B 'version':30B","search_c":"'12.1.0.0':56C '12.1.1.2':58C 'allow':60C 'api':54C 'attack':63C 'code':76C 'connect':55C 'could':59C 'cryptograph':77C 'due':68C 'hard':75C 'hard-cod':74C 'ibm':53C 'inform':67C 'key':78C 'obtain':65C 'remot':62C 'sensit':66C 'use':71C","first_public_at":"2026-11-07T05:18:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17310","severity":null,"published_at":"2026-11-07T05:18:39+00:00","modified_at":"2026-11-07T05:18:39+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","fetched_at":"2026-11-07T05:46:02+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}