{"id":"CVE-2026-17356","kind":"vulnerability","aliases":["CVE-2026-17356"],"related":[],"title":"IBM API Connect: hard-coded cryptographic key exposes sensitive information locally","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a hard-coded cryptographic key. A local attacker who can read the software can use that key to obtain sensitive information.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["version-outside-range"],"how_to_check":"Find your installed API Connect V12 OnPrem version. Affected: v12.1.0.0 through v12.1.1.2. Fixed: v12.1.1.3. The 10.0.8 line is not listed for this CVE in IBM's 10.0.8 bulletin.","fix":"Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:47+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","triaged_at":"2026-11-07T05:48:47+00:00","updated_at":"2026-11-07T06:13:05+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:48:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"IBM API Connect: hard-coded cryptographic key exposes sensitive information locally","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a hard-coded cryptographic key. A local attacker who can read the software can use that key to obtain sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local attacker obtains sensitive information using the hard-coded key","analyst_note":"Confirm the fixed version and any vendor advisory details for IBM API Connect 12.1.x; the sources give only the NVD description.","how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams that run IBM API Connect 12.1.0.0 through 12.1.1.2 on their own infrastructure are potentially exposed. The attack requires local access to the system, so exposure depends on who can log in or run code on those hosts. unknown whether the sources describe any further conditions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":4195,"output_tokens":509,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any vendor advisory details for IBM API Connect 12.1.x; the sources give only the NVD description.","search":"'-17356':15A,18A '-2026':14A,17A '12.1.0.0':35B,64C '12.1.1.2':37B,66C 'allow':68C 'api':2A,19A,25B,32B,62C 'attack':47B,71C 'code':6A,42B,84C 'connect':3A,20A,26B,33B,63C 'contain':38B 'could':67C 'cryptograph':7A,43B,85C 'cve':13A,16A 'due':76C 'expos':9A 'hard':5A,41B,83C 'hard-cod':4A,40B,82C 'host':30B 'ibm':1A,24B,31B,61C 'ibm-api-connect':23B 'inform':11A,60B,75C 'infrastructur':27B 'key':8A,44B,56B,86C 'local':12A,46B,70C 'obtain':58B,73C 'onprem':22A 'read':50B 'self':29B 'self-host':28B 'sensit':10A,59B,74C 'softwar':52B 'use':54B,79C 'v12':21A 'version':34B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect V12 OnPrem 12.1.0.0 through 12.1.1.2. IBM describes a hard-coded cryptographic key that a local attacker could use to obtain sensitive information, though its CVSS vector is network-based with high complexity, so treat it as reachable. Teams on 12.1.1.3 or later, or on the 10.0.8 line, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:13:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2028},"products":{"at":"2026-11-07T06:13:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2028},"workarounds":{"at":"2026-11-07T06:13:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2028},"how_to_check":{"at":"2026-11-07T06:13:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2028},"who_affected":{"at":"2026-11-07T06:13:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2028}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17356':15A,18A '-2026':14A,17A 'api':2A,19A 'code':6A 'connect':3A,20A 'cryptograph':7A 'cve':13A,16A 'expos':9A 'hard':5A 'hard-cod':4A 'ibm':1A 'inform':11A 'key':8A 'local':12A 'onprem':22A 'sensit':10A 'v12':21A","search_b":"'12.1.0.0':35B '12.1.1.2':37B 'api':25B,32B 'attack':47B 'code':42B 'connect':26B,33B 'contain':38B 'cryptograph':43B 'hard':41B 'hard-cod':40B 'host':30B 'ibm':24B,31B 'ibm-api-connect':23B 'inform':60B 'infrastructur':27B 'key':44B,56B 'local':46B 'obtain':58B 'read':50B 'self':29B 'self-host':28B 'sensit':59B 'softwar':52B 'use':54B 'version':34B","search_c":"'12.1.0.0':64C '12.1.1.2':66C 'allow':68C 'api':62C 'attack':71C 'code':84C 'connect':63C 'could':67C 'cryptograph':85C 'due':76C 'hard':83C 'hard-cod':82C 'ibm':61C 'inform':75C 'key':86C 'local':70C 'obtain':73C 'sensit':74C 'use':79C","first_public_at":"2026-11-07T05:18:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17356","severity":null,"published_at":"2026-11-07T05:18:47+00:00","modified_at":"2026-11-07T05:18:47+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","fetched_at":"2026-11-07T05:46:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17356:2028","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:13:05+00:00","modified_at":"2026-11-07T06:13:05+00:00","first_seen_at":"2026-11-07T06:13:05+00:00","fetched_at":"2026-11-07T06:13:05+00:00","note":"Read IBM bulletin ...-api-connect-39: CVE-2026-17356 (CWE-321, CVSS 8.7) listed, V12 OnPrem v12.1.0.0-v12.1.1.2, fixed v12.1.1.3, no workarounds. Bulletin says 'local attacker' but vector is AV:N/AC:H; discrepancy unexplained. 10.0.8 bulletin (-41) does not list this CVE. No exploitation or PoC checked beyond bulletin; social search skipped.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}