{"id":"CVE-2026-17328","kind":"vulnerability","aliases":["CVE-2026-17328"],"related":[],"title":"IBM API Connect: input validation gap leaks sensitive information to authenticated users","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Input checks are incomplete, which could allow them to be bypassed.","summary":"IBM API Connect V12 OnPrem v12.1.0.0 through v12.1.1.2 has incomplete input checks (IBM maps it to server-side request forgery, CWE-918) that a logged-in remote attacker can bypass to read sensitive information. IBM fixed it in v12.1.1.3 and lists no workarounds.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-connect","api-gateway","ibm","infrastructure","self-hosted"],"not_affected_if":["fixed-v12.1.1.3","outside-affected-range"],"how_to_check":"Check your API Connect V12 OnPrem version. Versions v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 or later is fixed.","fix":"Upgrade IBM API Connect to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:43+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","triaged_at":"2026-11-07T05:50:08+00:00","updated_at":"2026-11-07T06:16:24+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:50:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: input validation gap leaks sensitive information to authenticated users","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 have incomplete input validation that an attacker can bypass. A remote attacker who already has a valid account can use this to obtain sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm","api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads sensitive information they should not see","analyst_note":"Check IBM's security bulletin for API Connect 12.1.x for the fixed version and affected components; the NVD entry gives only the range.","how_to_check":"- Check the installed API Connect version against the affected range 12.1.0.0 through 12.1.1.2\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["outside-affected-range"],"who_is_affected":"Organizations running IBM API Connect in the 12.1.0.0 to 12.1.1.2 range. The attacker needs a valid account on the platform, so exposure depends on who can log in. The sources do not say which deployment settings are required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000672,"input_tokens":4213,"output_tokens":502,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for API Connect 12.1.x for the fixed version and affected components; the NVD entry gives only the range.","search":"'-17328':15A,18A '-2026':14A,17A '-918':56B '12.1.0.0':82C '12.1.1.2':84C 'allow':86C,106C 'api':2A,19A,24B,27B,35B,80C 'api-connect':23B 'api-gateway':26B 'attack':63B,90C 'authent':11A,89C 'bypass':65B,110C 'check':45B,101C 'connect':3A,20A,25B,36B,81C 'could':85C,105C 'cve':13A,16A 'cwe':55B 'due':95C 'fix':71B 'forgeri':54B 'gap':6A 'gateway':28B 'host':33B 'ibm':1A,29B,34B,46B,70B,79C 'improp':97C 'incomplet':43B,103C 'inform':9A,69B,94C 'infrastructur':30B 'input':4A,44B,98C,100C 'leak':7A 'list':76B 'log':60B 'logged-in':59B 'map':47B 'obtain':92C 'onprem':22A,38B 'read':67B 'remot':62B,88C 'request':53B 'self':32B 'self-host':31B 'sensit':8A,68B,93C 'server':51B 'server-sid':50B 'side':52B 'user':12A 'v12':21A,37B 'v12.1.0.0':39B 'v12.1.1.2':41B 'v12.1.1.3':74B 'valid':5A,99C 'workaround':78B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect V12 OnPrem, versions v12.1.0.0 through v12.1.1.2. An attacker needs a valid account (remote, low privilege), so exposure depends on who can log in to the platform; IBM classes the flaw as server-side request forgery, where the server can be made to fetch content it should not return. IBM lists only the V12 OnPrem product in this bulletin, so other API Connect lines are not confirmed affected.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:16:24Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2040},"products":{"at":"2026-11-07T06:16:24Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2040},"workarounds":{"at":"2026-11-07T06:16:24Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2040},"how_to_check":{"at":"2026-11-07T06:16:24Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2040},"who_affected":{"at":"2026-11-07T06:16:24Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2040}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apiconnect","apigateway","high","ibm","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17328':15A,18A '-2026':14A,17A 'api':2A,19A 'authent':11A 'connect':3A,20A 'cve':13A,16A 'gap':6A 'ibm':1A 'inform':9A 'input':4A 'leak':7A 'onprem':22A 'sensit':8A 'user':12A 'v12':21A 'valid':5A","search_b":"'-918':56B 'api':24B,27B,35B 'api-connect':23B 'api-gateway':26B 'attack':63B 'bypass':65B 'check':45B 'connect':25B,36B 'cwe':55B 'fix':71B 'forgeri':54B 'gateway':28B 'host':33B 'ibm':29B,34B,46B,70B 'incomplet':43B 'inform':69B 'infrastructur':30B 'input':44B 'list':76B 'log':60B 'logged-in':59B 'map':47B 'onprem':38B 'read':67B 'remot':62B 'request':53B 'self':32B 'self-host':31B 'sensit':68B 'server':51B 'server-sid':50B 'side':52B 'v12':37B 'v12.1.0.0':39B 'v12.1.1.2':41B 'v12.1.1.3':74B 'workaround':78B","search_c":"'12.1.0.0':82C '12.1.1.2':84C 'allow':86C,106C 'api':80C 'attack':90C 'authent':89C 'bypass':110C 'check':101C 'connect':81C 'could':85C,105C 'due':95C 'ibm':79C 'improp':97C 'incomplet':103C 'inform':94C 'input':98C,100C 'obtain':92C 'remot':88C 'sensit':93C 'valid':99C","first_public_at":"2026-11-07T05:18:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17328","severity":null,"published_at":"2026-11-07T05:18:43+00:00","modified_at":"2026-11-07T05:18:43+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","fetched_at":"2026-11-07T05:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17328:2040","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:16:24+00:00","modified_at":"2026-11-07T06:16:24+00:00","first_seen_at":"2026-11-07T06:16:24+00:00","fetched_at":"2026-11-07T06:16:24+00:00","note":"IBM bulletin (API Connect v12.1.1.3) lists CVE-2026-17328 as CWE-918 SSRF-type input validation flaw, CVSS 8.5; affected API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fix v12.1.1.3, no workarounds. No exploitation or PoC checked beyond bulletin; social search skipped (CVE has no named discussion).","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}