{"id":"CVE-2026-17345","kind":"vulnerability","aliases":["CVE-2026-17345"],"related":[],"title":"IBM API Connect: SQL injection lets signed-in users read sensitive data","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 mishandle special characters in SQL commands. A remote attacker with a valid account can use this to obtain sensitive information.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"IBM API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure"],"not_affected_if":["unaffected-version"],"how_to_check":"Find your API Connect version. Exposed if it is 10.0.8.0 through 10.0.8.12, or V12 OnPrem 12.1.0.0 through 12.1.1.2. Not exposed on 10.0.8.13 or 12.1.1.3 or later.","fix":"Upgrade to 10.0.8.13 (10.0.8.x line) or 12.1.1.3 (V12 OnPrem, 12.1.x line) via IBM Fix Central. IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:46+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","triaged_at":"2026-11-07T05:50:43+00:00","updated_at":"2026-11-07T06:14:25+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-07T05:50:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: SQL injection lets signed-in users read sensitive data","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 mishandle special characters in SQL commands. A remote attacker with a valid account can use this to obtain sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker reads sensitive information through SQL injection","analyst_note":"Check the IBM security bulletin for API Connect to confirm fixed versions and any required setting changes; the NVD entry alone gives no fix.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organisations running IBM API Connect in the affected version ranges are exposed, and the attacker must be an authenticated remote user. The sources do not describe specific configurations or features that widen the exposure. Teams on other versions or other API gateways can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4235,"output_tokens":546,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for API Connect to confirm fixed versions and any required setting changes; the NVD entry alone gives no fix.","search":"'-17345':16A,19A '-2026':15A,18A '10.0.8.0':40B,70C '10.0.8.12':42B,72C '12.1.0.0':44B,74C '12.1.1.2':46B,76C 'account':59B 'allow':78C 'api':2A,21A,24A,29B,33B,37B,68C 'api-gateway':28B 'attack':55B,82C 'authent':81C 'charact':49B 'command':52B,98C 'connect':3A,22A,25A,34B,38B,69C 'could':77C 'cve':14A,17A 'data':13A 'due':87C 'element':93C 'gateway':30B 'ibm':1A,20A,23A,32B,36B,67C 'ibm-api-connect':31B 'improp':89C 'inform':66B,86C 'infrastructur':35B 'inject':5A 'let':6A 'mishandl':47B 'neutral':90C 'obtain':64B,84C 'onprem':27A 'read':11A 'remot':54B,80C 'sensit':12A,65B,85C 'sign':8A 'signed-in':7A 'special':48B,92C 'sql':4A,51B,97C 'use':61B,94C 'user':10A 'v12':26A 'valid':58B 'version':39B","nicknames":[],"mitigations":[],"who_affected":"Organisations running IBM API Connect in the affected version ranges are exposed, and the attacker must be an authenticated remote user. The sources do not describe specific configurations or features that widen the exposure. Teams on other versions or other API gateways can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:14:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2031},"products":{"at":"2026-11-07T06:14:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2031},"workarounds":{"at":"2026-11-07T06:14:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2031},"how_to_check":{"at":"2026-11-07T06:14:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2031}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","ibmapiconnect","ibmapiconnectv12onprem"],"ptokens":["api","connect","ibm","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","infrastructure"],"campaign_type":null,"search_a":"'-17345':16A,19A '-2026':15A,18A 'api':2A,21A,24A 'connect':3A,22A,25A 'cve':14A,17A 'data':13A 'ibm':1A,20A,23A 'inject':5A 'let':6A 'onprem':27A 'read':11A 'sensit':12A 'sign':8A 'signed-in':7A 'sql':4A 'user':10A 'v12':26A","search_b":"'10.0.8.0':40B '10.0.8.12':42B '12.1.0.0':44B '12.1.1.2':46B 'account':59B 'api':29B,33B,37B 'api-gateway':28B 'attack':55B 'charact':49B 'command':52B 'connect':34B,38B 'gateway':30B 'ibm':32B,36B 'ibm-api-connect':31B 'inform':66B 'infrastructur':35B 'mishandl':47B 'obtain':64B 'remot':54B 'sensit':65B 'special':48B 'sql':51B 'use':61B 'valid':58B 'version':39B","search_c":"'10.0.8.0':70C '10.0.8.12':72C '12.1.0.0':74C '12.1.1.2':76C 'allow':78C 'api':68C 'attack':82C 'authent':81C 'command':98C 'connect':69C 'could':77C 'due':87C 'element':93C 'ibm':67C 'improp':89C 'inform':86C 'neutral':90C 'obtain':84C 'remot':80C 'sensit':85C 'special':92C 'sql':97C 'use':94C","first_public_at":"2026-11-07T05:18:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17345","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17345","severity":null,"published_at":"2026-11-07T05:18:46+00:00","modified_at":"2026-11-07T05:18:46+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","fetched_at":"2026-11-07T05:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17345:2031","url":"https://www.ibm.com/support/pages/node/7295637","severity":null,"published_at":"2026-11-07T06:14:25+00:00","modified_at":"2026-11-07T06:14:25+00:00","first_seen_at":"2026-11-07T06:14:25+00:00","fetched_at":"2026-11-07T06:14:25+00:00","note":"Read two IBM bulletins (node/7295637 for 10.0.8.x -> 10.0.8.13; ...api-connect-39 for V12 OnPrem 12.1.0.0-12.1.1.2 -> 12.1.1.3). Both list CVE-2026-17345, no workarounds. No exploitation or PoC seen; did not search social.","cites":["https://www.ibm.com/support/pages/node/7295637","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93164,"url":"https://www.ibm.com/support/pages/node/7295637","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}