{"id":"CVE-2026-17315","kind":"vulnerability","aliases":["CVE-2026-17315"],"related":[],"title":"IBM API Connect: improper URL validation leaks sensitive information to remote attackers","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of user-supplied URLs.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not properly validate user-supplied URLs. A remote attacker can use this to obtain sensitive information from the product.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure"],"not_affected_if":[],"how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`","fix":null,"status":"open","published_at":"2026-11-07T05:18:40+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","triaged_at":"2026-11-07T05:52:49+00:00","updated_at":"2026-11-07T05:52:49+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-07T05:52:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: improper URL validation leaks sensitive information to remote attackers","impact":"low","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not properly validate user-supplied URLs. A remote attacker can use this to obtain sensitive information from the product.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker obtains sensitive information from the product","analyst_note":"Check the IBM security bulletin for API Connect 12.1.x for the fixed version, required privileges, and whether the URL-handling feature must be enabled.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 are exposed. The sources do not describe which deployment configurations or roles make an instance reachable by the attacker. unknown for who can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00067,"input_tokens":4195,"output_tokens":500,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17315':15A,18A '-2026':14A,17A '12.1.0.0':31B,58C '12.1.1.2':33B,60C 'allow':62C 'api':2A,20B,24B,28B,56C 'api-gateway':19B 'attack':12A,44B,65C 'connect':3A,25B,29B,57C 'could':61C 'cve':13A,16A 'due':70C 'gateway':21B 'ibm':1A,23B,27B,55C 'ibm-api-connect':22B 'improp':4A,72C 'inform':9A,51B,69C 'infrastructur':26B 'leak':7A 'obtain':49B,67C 'product':54B 'proper':36B 'remot':11A,43B,64C 'sensit':8A,50B,68C 'suppli':40B,77C 'url':5A,41B,78C 'use':46B 'user':39B,76C 'user-suppli':38B,75C 'valid':6A,37B,73C 'version':30B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 are exposed. The sources do not describe which deployment configurations or roles make an instance reachable by the attacker. unknown for who can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","infrastructure","medium"],"campaign_type":null,"search_a":"'-17315':15A,18A '-2026':14A,17A 'api':2A 'attack':12A 'connect':3A 'cve':13A,16A 'ibm':1A 'improp':4A 'inform':9A 'leak':7A 'remot':11A 'sensit':8A 'url':5A 'valid':6A","search_b":"'12.1.0.0':31B '12.1.1.2':33B 'api':20B,24B,28B 'api-gateway':19B 'attack':44B 'connect':25B,29B 'gateway':21B 'ibm':23B,27B 'ibm-api-connect':22B 'inform':51B 'infrastructur':26B 'obtain':49B 'product':54B 'proper':36B 'remot':43B 'sensit':50B 'suppli':40B 'url':41B 'use':46B 'user':39B 'user-suppli':38B 'valid':37B 'version':30B","search_c":"'12.1.0.0':58C '12.1.1.2':60C 'allow':62C 'api':56C 'attack':65C 'connect':57C 'could':61C 'due':70C 'ibm':55C 'improp':72C 'inform':69C 'obtain':67C 'remot':64C 'sensit':68C 'suppli':77C 'url':78C 'user':76C 'user-suppli':75C 'valid':73C","first_public_at":"2026-11-07T05:18:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17315","severity":null,"published_at":"2026-11-07T05:18:40+00:00","modified_at":"2026-11-07T05:18:40+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","fetched_at":"2026-11-07T05:46:03+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}