{"id":"CVE-2026-17334","kind":"vulnerability","aliases":["CVE-2026-17334"],"related":[],"title":"IBM API Connect: authenticated users can obtain sensitive information remotely","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization via user-controlled keys.","summary":"IBM API Connect 12.1.0.0 through 12.1.1.2 has an improper authorization flaw driven by user-controlled keys. A remote attacker with a valid account can obtain sensitive information they should not see.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","auth-required","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["auth-required","no-authenticated-remote-users","unaffected-version"],"how_to_check":"Check your IBM API Connect V12 on-prem version; versions v12.1.0.0 through v12.1.1.2 are affected, v12.1.1.3 is fixed.","fix":"Upgrade IBM API Connect to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:44+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","triaged_at":"2026-11-07T05:50:08+00:00","updated_at":"2026-11-07T06:15:20+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:50:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can obtain sensitive information remotely","impact":"medium","summary":"IBM API Connect 12.1.0.0 through 12.1.1.2 has an improper authorization flaw driven by user-controlled keys. A remote attacker with a valid account can obtain sensitive information they should not see.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker reads sensitive information belonging to others","analyst_note":"Check IBM's security bulletin for API Connect 12.1.x for the fixed version and affected endpoints; the NVD entry alone does not give them.","how_to_check":"- Check the installed IBM API Connect version against the affected range 12.1.0.0 through 12.1.1.2\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version","no-authenticated-remote-users"],"who_is_affected":"IBM API Connect 12.1.0.0 through 12.1.1.2 deployments where remote users hold accounts. Sources do not say which configurations or roles are exposed. Teams on other versions or without authenticated remote users are likely not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4199,"output_tokens":511,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for API Connect 12.1.x for the fixed version and affected endpoints; the NVD entry alone does not give them.","search":"'-17334':13A,16A '-2026':12A,15A '12.1.0.0':38B,70C '12.1.1.2':40B,72C 'account':58B 'allow':74C 'api':2A,17A,22B,29B,36B,68C 'api-gateway':21B 'attack':54B,78C 'auth':25B 'auth-requir':24B 'authent':4A,77C 'author':44B,86C 'connect':3A,18A,30B,37B,69C 'control':50B,90C 'could':73C 'cve':11A,14A 'driven':46B 'due':83C 'flaw':45B 'gateway':23B 'host':34B 'ibm':1A,28B,35B,67C 'ibm-api-connect':27B 'improp':43B,85C 'inform':9A,62B,82C 'infrastructur':31B 'key':51B,91C 'obtain':7A,60B,80C 'onprem':20A 'remot':10A,53B,76C 'requir':26B 'see':66B 'self':33B 'self-host':32B 'sensit':8A,61B,81C 'user':5A,49B,89C 'user-control':48B,88C 'v12':19A 'valid':57B 'via':87C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect V12 on-premises, versions 12.1.0.0 through 12.1.1.2. An attacker needs a valid account, then can read information they should not see by manipulating user-controlled keys (CWE-639). IBM's bulletin does not name the endpoints. Other API Connect lines are not listed in this bulletin.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:15:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2035},"products":{"at":"2026-11-07T06:15:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2035},"workarounds":{"at":"2026-11-07T06:15:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2035},"how_to_check":{"at":"2026-11-07T06:15:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2035},"who_affected":{"at":"2026-11-07T06:15:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2035}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authrequired","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17334':13A,16A '-2026':12A,15A 'api':2A,17A 'authent':4A 'connect':3A,18A 'cve':11A,14A 'ibm':1A 'inform':9A 'obtain':7A 'onprem':20A 'remot':10A 'sensit':8A 'user':5A 'v12':19A","search_b":"'12.1.0.0':38B '12.1.1.2':40B 'account':58B 'api':22B,29B,36B 'api-gateway':21B 'attack':54B 'auth':25B 'auth-requir':24B 'author':44B 'connect':30B,37B 'control':50B 'driven':46B 'flaw':45B 'gateway':23B 'host':34B 'ibm':28B,35B 'ibm-api-connect':27B 'improp':43B 'inform':62B 'infrastructur':31B 'key':51B 'obtain':60B 'remot':53B 'requir':26B 'see':66B 'self':33B 'self-host':32B 'sensit':61B 'user':49B 'user-control':48B 'valid':57B","search_c":"'12.1.0.0':70C '12.1.1.2':72C 'allow':74C 'api':68C 'attack':78C 'authent':77C 'author':86C 'connect':69C 'control':90C 'could':73C 'due':83C 'ibm':67C 'improp':85C 'inform':82C 'key':91C 'obtain':80C 'remot':76C 'sensit':81C 'user':89C 'user-control':88C 'via':87C","first_public_at":"2026-11-07T05:18:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17334","severity":null,"published_at":"2026-11-07T05:18:44+00:00","modified_at":"2026-11-07T05:18:44+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","fetched_at":"2026-11-07T05:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17334:2035","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:15:20+00:00","modified_at":"2026-11-07T06:15:20+00:00","first_seen_at":"2026-11-07T06:15:20+00:00","fetched_at":"2026-11-07T06:15:20+00:00","note":"Read IBM bulletin (-39): CWE-639, CVSS 8.5, affected API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fix v12.1.1.3, workarounds None. Endpoints not named by IBM. Skipped social search.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}