{"id":"CVE-2026-17312","kind":"vulnerability","aliases":["CVE-2026-17312"],"related":[],"title":"IBM API Connect: forced login into attacker-controlled account via cross-site request forgery","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not sufficiently verify that a login response belongs to the user's own sign-in request. A remote attacker can use cross-site request forgery to make a victim sign into an attacker-controlled account and link the victim's session to it.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":[],"how_to_check":"- Check the installed API Connect version against the affected range 12.1.0.0 through 12.1.1.2.","fix":null,"status":"open","published_at":"2026-11-07T05:18:39+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","triaged_at":"2026-11-07T05:54:05+00:00","updated_at":"2026-11-07T05:54:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:54:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: forced login into attacker-controlled account via cross-site request forgery","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not sufficiently verify that a login response belongs to the user's own sign-in request. A remote attacker can use cross-site request forgery to make a victim sign into an attacker-controlled account and link the victim's session to it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"victim's session is linked to an attacker-controlled account","analyst_note":"Find the IBM security bulletin for CVE-2026-17312 to confirm the fixed version and any mitigation; the sources give only the affected range.","how_to_check":"- Check the installed API Connect version against the affected range 12.1.0.0 through 12.1.1.2.\n- unknown for further checks; the sources do not say how to test the login flow.","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams that run IBM API Connect in the 12.1.0.0 to 12.1.1.2 range are affected through its sign-in flow. The sources do not say which deployment settings change exposure, so the sources do not establish who can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":4250,"output_tokens":535,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17312':19A,22A '-2026':18A,21A '12.1.0.0':35B,86C '12.1.1.2':37B,88C 'account':10A,76B,105C,142C 'allow':90C 'api':2A,25B,32B,84C 'attack':8A,58B,74B,93C,103C,146C 'attacker-control':7A,73B,102C 'authent':99C 'belong':46B,126C 'connect':3A,26B,33B,85C 'control':9A,75B,104C,143C 'could':89C,134C 'cross':13A,62B,109C 'cross-sit':12A,61B,108C 'cve':17A,20A 'due':106C 'flow':117C 'forc':4A,95C 'forgeri':16A,65B,112C 'host':30B 'ibm':1A,24B,31B,83C 'ibm-api-connect':23B 'infrastructur':27B 'link':78B,135C 'login':5A,44B,124C 'make':67B 'remot':57B,92C 'request':15A,55B,64B,111C,132C 'respons':45B,125C 'self':29B 'self-host':28B 'session':82B,139C 'sign':53B,70B,115C 'sign-in':52B,114C 'site':14A,63B,110C 'suffici':40B,120C 'use':60B 'user':49B,97C,129C 'verifi':41B,121C 'version':34B 'via':11A 'victim':69B,80B,137C","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM API Connect in the 12.1.0.0 to 12.1.1.2 range are affected through its sign-in flow. The sources do not say which deployment settings change exposure, so the sources do not establish who can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmapiconnect","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-17312':19A,22A '-2026':18A,21A 'account':10A 'api':2A 'attack':8A 'attacker-control':7A 'connect':3A 'control':9A 'cross':13A 'cross-sit':12A 'cve':17A,20A 'forc':4A 'forgeri':16A 'ibm':1A 'login':5A 'request':15A 'site':14A 'via':11A","search_b":"'12.1.0.0':35B '12.1.1.2':37B 'account':76B 'api':25B,32B 'attack':58B,74B 'attacker-control':73B 'belong':46B 'connect':26B,33B 'control':75B 'cross':62B 'cross-sit':61B 'forgeri':65B 'host':30B 'ibm':24B,31B 'ibm-api-connect':23B 'infrastructur':27B 'link':78B 'login':44B 'make':67B 'remot':57B 'request':55B,64B 'respons':45B 'self':29B 'self-host':28B 'session':82B 'sign':53B,70B 'sign-in':52B 'site':63B 'suffici':40B 'use':60B 'user':49B 'verifi':41B 'version':34B 'victim':69B,80B","search_c":"'12.1.0.0':86C '12.1.1.2':88C 'account':105C,142C 'allow':90C 'api':84C 'attack':93C,103C,146C 'attacker-control':102C 'authent':99C 'belong':126C 'connect':85C 'control':104C,143C 'could':89C,134C 'cross':109C 'cross-sit':108C 'due':106C 'flow':117C 'forc':95C 'forgeri':112C 'ibm':83C 'link':135C 'login':124C 'remot':92C 'request':111C,132C 'respons':125C 'session':139C 'sign':115C 'sign-in':114C 'site':110C 'suffici':120C 'user':97C,129C 'verifi':121C 'victim':137C","first_public_at":"2026-11-07T05:18:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17312","severity":null,"published_at":"2026-11-07T05:18:39+00:00","modified_at":"2026-11-07T05:18:40+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","fetched_at":"2026-11-07T05:46:02+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}