{"id":"CVE-2026-17313","kind":"vulnerability","aliases":["CVE-2026-17313"],"related":[],"title":"IBM API Connect: authentication bypass exposes gateway configuration to remote attackers","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and take control of gateway configuration due to authentication bypass via an alternate path.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authentication bypass through an alternate path. A remote attacker can obtain sensitive information and take control of gateway configuration.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","on-prem","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"Check your IBM API Connect V12 OnPrem version. v12.1.0.0 through v12.1.1.2 is affected; v12.1.1.3 contains the fix. Also check whether any API Connect gateway or management endpoint can be reached from untrusted networks. IBM's bulletin does not say which path is used or whether a setting is required.","fix":"Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds or mitigations.","status":"open","published_at":"2026-11-07T05:18:40+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","triaged_at":"2026-11-07T05:48:20+00:00","updated_at":"2026-11-07T05:55:04+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authentication bypass exposes gateway configuration to remote attackers","impact":"high","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authentication bypass through an alternate path. A remote attacker can obtain sensitive information and take control of gateway configuration.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker takes control of gateway configuration and reads sensitive data","analyst_note":"Find the IBM security bulletin for CVE-2026-17313 to confirm the fixed version, the alternate path and any required configuration.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- Confirm which API Connect gateways are reachable from the internet","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running IBM API Connect 12.1.0.0 through 12.1.1.2 as an API gateway, where the gateway is reachable over the network. The sources do not describe the specific alternate path or any non-default setting required. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000675,"input_tokens":4204,"output_tokens":509,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-17313 to confirm the fixed version, the alternate path and any required configuration.","search":"'-17313':14A,17A '-2026':13A,16A '12.1.0.0':40B,67C '12.1.1.2':42B,69C 'allow':71C 'altern':49B,91C 'api':2A,18A,23B,27B,37B,65C 'api-gateway':22B 'attack':11A,53B,74C 'authent':4A,45B,87C 'bypass':5A,46B,88C 'configur':8A,63B,84C 'connect':3A,19A,28B,38B,66C 'contain':43B 'control':60B,81C 'could':70C 'cve':12A,15A 'due':85C 'expos':6A 'gateway':7A,24B,62B,83C 'host':34B 'ibm':1A,26B,36B,64C 'ibm-api-connect':25B 'inform':57B,78C 'obtain':55B,76C 'on-prem':29B 'onprem':21A 'path':50B,92C 'prem':31B 'remot':10A,52B,73C 'self':33B 'self-host':32B 'sensit':56B,77C 'take':59B,80C 'v12':20A 'vendor':35B 'version':39B 'via':89C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect V12 OnPrem, versions 12.1.0.0 through 12.1.1.2. IBM rates the flaw 9.8: it needs no authentication or user interaction and is exploitable over the network. A remote attacker could read sensitive information and take control of gateway configuration. The bulletin names no required setting, so treat every affected install as exposed. Teams on API Connect 10.0.8.x are not in this bulletin's affected list.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:55:04Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1979},"products":{"at":"2026-11-07T05:55:04Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1979},"workarounds":{"at":"2026-11-07T05:55:04Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1979},"how_to_check":{"at":"2026-11-07T05:55:04Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1979},"who_affected":{"at":"2026-11-07T05:55:04Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1979}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","critical","ibmapiconnect","onprem","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17313':14A,17A '-2026':13A,16A 'api':2A,18A 'attack':11A 'authent':4A 'bypass':5A 'configur':8A 'connect':3A,19A 'cve':12A,15A 'expos':6A 'gateway':7A 'ibm':1A 'onprem':21A 'remot':10A 'v12':20A","search_b":"'12.1.0.0':40B '12.1.1.2':42B 'altern':49B 'api':23B,27B,37B 'api-gateway':22B 'attack':53B 'authent':45B 'bypass':46B 'configur':63B 'connect':28B,38B 'contain':43B 'control':60B 'gateway':24B,62B 'host':34B 'ibm':26B,36B 'ibm-api-connect':25B 'inform':57B 'obtain':55B 'on-prem':29B 'path':50B 'prem':31B 'remot':52B 'self':33B 'self-host':32B 'sensit':56B 'take':59B 'vendor':35B 'version':39B","search_c":"'12.1.0.0':67C '12.1.1.2':69C 'allow':71C 'altern':91C 'api':65C 'attack':74C 'authent':87C 'bypass':88C 'configur':84C 'connect':66C 'control':81C 'could':70C 'due':85C 'gateway':83C 'ibm':64C 'inform':78C 'obtain':76C 'path':92C 'remot':73C 'sensit':77C 'take':80C 'via':89C","first_public_at":"2026-11-07T05:18:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17313","severity":null,"published_at":"2026-11-07T05:18:40+00:00","modified_at":"2026-11-07T05:18:40+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","fetched_at":"2026-11-07T05:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17313:1979","url":"https://www.ibm.com/support/pages/node/7295635","severity":null,"published_at":"2026-11-07T05:55:04+00:00","modified_at":"2026-11-07T05:55:04+00:00","first_seen_at":"2026-11-07T05:55:04+00:00","fetched_at":"2026-11-07T05:55:04+00:00","note":"Read IBM bulletin node/7295635: CVE-2026-17313 (CWE-288, 9.8) affects API Connect V12 OnPrem v12.1.0.0-v12.1.1.2; fix v12.1.1.3; workarounds None. Bulletin gives no detail on the alternate path or required config. No exploitation or PoC seen (Feedly). X not searched. Page metadata lists range to 12.1.1.3 but table says 12.1.1.2.","cites":["https://www.ibm.com/support/pages/node/7295635"]}],"documents":[{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}