CVE-2026-17322 · Vendor
NO FIX YET · SEE WHAT TO DO
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 write sensitive information into log files. A local attacker who can read those logs can obtain credentials and compromise accounts.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running IBM API Connect in the affected version ranges. The exposure requires local access to the host's log files, so systems where only trusted administrators can read logs face less risk. unknown for further details from the sources.
Not affected if unaffected-version
Who cares ibm-api-connect, self-hosted
10.0.8.0 through 10.0.8.12 or 12.1.0.0 through 12.1.1.210.0.8.12 or 12.1.1.2 in the affected lines; the exact fixed version is unknown from the sourcesIBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.