{"id":"CVE-2026-17324","kind":"vulnerability","aliases":["CVE-2026-17324"],"related":[],"title":"IBM API Connect: missing authentication exposes configuration data and unauthorized actions","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 lack authentication on a critical function. A remote attacker can read sensitive configuration data and perform unauthorized actions.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","auth-bypass","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"Check the installed API Connect version. Versions 12.1.0.0 through 12.1.1.2 are affected; v12.1.1.3 is the fixed release. Also check which API Connect components (management, gateway, portal) are reachable from untrusted networks. IBM's text does not name the affected endpoint.","fix":"Upgrade IBM API Connect to v12.1.1.3 (Fix Central; release page https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:42+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","triaged_at":"2026-11-07T05:50:23+00:00","updated_at":"2026-11-07T06:17:39+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-07T05:50:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: missing authentication exposes configuration data and unauthorized actions","impact":"high","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 lack authentication on a critical function. A remote attacker can read sensitive configuration data and perform unauthorized actions.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker reads sensitive configuration and performs unauthorized actions","analyst_note":"Find the IBM security bulletin for CVE-2026-17324 to get the fixed version, affected endpoints and any workaround.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running IBM API Connect 12.1.0.0 through 12.1.1.2 that expose its endpoints to a network the attacker can reach. The sources do not say which endpoints or deployment modes are affected, so whether a given install is exposed is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":4202,"output_tokens":511,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-17324 to get the fixed version, affected endpoints and any workaround.","search":"'-17324':14A,17A '-2026':13A,16A '12.1.0.0':39B,63C '12.1.1.2':41B,65C 'access':72C 'action':11A,59B,79C 'allow':67C 'api':2A,19A,22B,29B,36B,61C 'api-gateway':21B 'attack':50B,70C 'auth':25B 'auth-bypass':24B 'authent':5A,43B,83C 'bypass':26B 'configur':7A,54B,74C 'connect':3A,20A,30B,37B,62C 'could':66C 'critic':46B,86C 'cve':12A,15A 'data':8A,55B,75C 'due':80C 'expos':6A 'function':47B,87C 'gateway':23B 'host':33B 'ibm':1A,18A,28B,35B,60C 'ibm-api-connect':27B 'lack':42B 'miss':4A,82C 'perform':57B,77C 'read':52B 'remot':49B,69C 'self':32B 'self-host':31B 'sensit':53B,73C 'unauthor':10A,58B,78C 'vendor':34B 'version':38B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted IBM API Connect 12.1.0.0 through 12.1.1.2 whose management or gateway endpoints can be reached by an unauthenticated remote attacker (CVSS 8.3, no privileges required). IBM says the flaw is missing authentication on a critical function. It does not name the endpoint. Teams on IBM API Connect 10.0.8.x are not listed for this CVE. Installs already on 12.1.1.3 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","ibmapiconnect"],"ptokens":["api","connect","ibm"],"labels":["apigateway","authbypass","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17324':14A,17A '-2026':13A,16A 'action':11A 'api':2A,19A 'authent':5A 'configur':7A 'connect':3A,20A 'cve':12A,15A 'data':8A 'expos':6A 'ibm':1A,18A 'miss':4A 'unauthor':10A","search_b":"'12.1.0.0':39B '12.1.1.2':41B 'action':59B 'api':22B,29B,36B 'api-gateway':21B 'attack':50B 'auth':25B 'auth-bypass':24B 'authent':43B 'bypass':26B 'configur':54B 'connect':30B,37B 'critic':46B 'data':55B 'function':47B 'gateway':23B 'host':33B 'ibm':28B,35B 'ibm-api-connect':27B 'lack':42B 'perform':57B 'read':52B 'remot':49B 'self':32B 'self-host':31B 'sensit':53B 'unauthor':58B 'vendor':34B 'version':38B","search_c":"'12.1.0.0':63C '12.1.1.2':65C 'access':72C 'action':79C 'allow':67C 'api':61C 'attack':70C 'authent':83C 'configur':74C 'connect':62C 'could':66C 'critic':86C 'data':75C 'due':80C 'function':87C 'ibm':60C 'miss':82C 'perform':77C 'remot':69C 'sensit':73C 'unauthor':78C","first_public_at":"2026-11-07T05:18:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17324","severity":null,"published_at":"2026-11-07T05:18:42+00:00","modified_at":"2026-11-07T05:18:42+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","fetched_at":"2026-11-07T05:46:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17324:2044","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:17:39+00:00","modified_at":"2026-11-07T06:17:39+00:00","first_seen_at":"2026-11-07T06:17:39+00:00","fetched_at":"2026-11-07T06:17:39+00:00","note":"IBM's fix is v12.1.1.3 per OpenCVE quoting IBM's vendor solution (node/7290205, the v12.1.1.3 release page). The IBM bulletin -39 fetched truncated, so I could not see CVE-2026-17324 on it. Fix is not marked verified. No workaround or endpoint list found. No exploitation or PoC found.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/node/7290205","https://app.opencve.io/cve/CVE-2026-17324"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93155,"url":"https://www.ibm.com/support/pages/node/7290205","title":"IBM API Connect v12.1.1.3 is now available","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":93447,"url":"https://app.opencve.io/cve/CVE-2026-17324","title":"OpenCVE: CVE-2026-17324 (quotes IBM vendor solution)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}