IBM API CONNECT · CVE-2026-17358 · Infrastructure
FIX → 10.0.8.13 · 12.1.1.3 ✓ verified
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not isolate authentication checks between tenants. A logged-in user from one tenant can be accepted by another tenant, which can expose that tenant's resources.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running IBM API Connect in the affected version ranges with more than one tenant sharing an instance. The sources do not say whether single-tenant deployments are affected. The attacker must already hold an account in some tenant on the same system.
Not affected if outside-affected-versions, single-tenant-deployment
Who cares api-gateway, ibm-api-connect, multi-tenant
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication across tenants due to improper authentication. Authentication checks are not sufficiently isolated between tenants, which could allow a user from one tenant to be accepted by another.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 10.0.8.13 · 12.1.1.3
10.0.8.x to 10.0.8.13, or 12.1.x to 12.1.1.3 (via IBM Fix Central)