{"id":"CVE-2026-17322","kind":"vulnerability","aliases":["CVE-2026-17322"],"related":[],"title":"IBM API Connect: logs expose credentials that let local users take over accounts","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 write sensitive information into log files. A local attacker who can read those logs can obtain credentials and compromise accounts.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-api-connect","self-hosted","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Confirm the installed IBM API Connect version and whether it falls in `10.0.8.0` through `10.0.8.12` or `12.1.0.0` through `12.1.1.2`","fix":"- Move to a release after `10.0.8.12` or `12.1.1.2` in the affected lines; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-11-07T05:18:41+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","triaged_at":"2026-11-07T05:52:16+00:00","updated_at":"2026-11-07T05:52:16+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:52:16Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release after `10.0.8.12` or `12.1.1.2` in the affected lines; the exact fixed version is unknown from the sources","reach":"local","title":"IBM API Connect: logs expose credentials that let local users take over accounts","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 write sensitive information into log files. A local attacker who can read those logs can obtain credentials and compromise accounts.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker reads credentials from logs and takes over accounts","analyst_note":"Check the IBM security bulletin for the fixed version and which log files and credentials are involved.","how_to_check":"- Confirm the installed IBM API Connect version and whether it falls in `10.0.8.0` through `10.0.8.12` or `12.1.0.0` through `12.1.1.2`\n- unknown for log file locations and which credentials are written; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Teams running IBM API Connect in the affected version ranges. The exposure requires local access to the host's log files, so systems where only trusted administrators can read logs face less risk. unknown for further details from the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4233,"output_tokens":562,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-17322':16A,19A '-2026':15A,18A '10.0.8.0':32B,62C '10.0.8.12':34B,64C '12.1.0.0':36B,66C '12.1.1.2':38B,68C 'account':13A,58B,80C 'allow':70C 'api':2A,22B,29B,60C 'attack':47B,73C 'compromis':57B,79C 'connect':3A,23B,30B,61C 'could':69C 'credenti':6A,55B,77C 'cve':14A,17A 'due':81C 'expos':5A 'file':44B,89C 'host':26B 'ibm':1A,21B,28B,59C 'ibm-api-connect':20B 'inform':41B,86C 'insert':83C 'let':8A 'local':9A,46B,72C 'log':4A,43B,52B,88C 'obtain':54B,75C 'read':50B 'self':25B 'self-host':24B 'sensit':40B,76C,85C 'take':11A 'user':10A 'vendor':27B 'version':31B 'write':39B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect in the affected version ranges. The exposure requires local access to the host's log files, so systems where only trusted administrators can read logs face less risk. unknown for further details from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17322':16A,19A '-2026':15A,18A 'account':13A 'api':2A 'connect':3A 'credenti':6A 'cve':14A,17A 'expos':5A 'ibm':1A 'let':8A 'local':9A 'log':4A 'take':11A 'user':10A","search_b":"'10.0.8.0':32B '10.0.8.12':34B '12.1.0.0':36B '12.1.1.2':38B 'account':58B 'api':22B,29B 'attack':47B 'compromis':57B 'connect':23B,30B 'credenti':55B 'file':44B 'host':26B 'ibm':21B,28B 'ibm-api-connect':20B 'inform':41B 'local':46B 'log':43B,52B 'obtain':54B 'read':50B 'self':25B 'self-host':24B 'sensit':40B 'vendor':27B 'version':31B 'write':39B","search_c":"'10.0.8.0':62C '10.0.8.12':64C '12.1.0.0':66C '12.1.1.2':68C 'account':80C 'allow':70C 'api':60C 'attack':73C 'compromis':79C 'connect':61C 'could':69C 'credenti':77C 'due':81C 'file':89C 'ibm':59C 'inform':86C 'insert':83C 'local':72C 'log':88C 'obtain':75C 'sensit':76C,85C","first_public_at":"2026-11-07T05:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17322","severity":null,"published_at":"2026-11-07T05:18:41+00:00","modified_at":"2026-11-07T05:18:42+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","fetched_at":"2026-11-07T05:46:03+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}