{"id":"CVE-2026-17358","kind":"vulnerability","aliases":["CVE-2026-17358"],"related":[],"title":"IBM API Connect: cross-tenant authentication bypass by authenticated users","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication across tenants due to improper authentication. Authentication checks are not sufficiently isolated between tenants, which could allow a user from one tenant to be accepted by another.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not isolate authentication checks between tenants. A logged-in user from one tenant can be accepted by another tenant, which can expose that tenant's resources.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"IBM API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","multi-tenant"],"not_affected_if":["outside-affected-versions","single-tenant-deployment"],"how_to_check":"- Check your installed API Connect version: affected are 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 (IBM lists V12 OnPrem).\n- Fixed in 10.0.8.13 and 12.1.1.3.\n- Multi-tenant or multi-organization shared instances are the main concern; IBM's bulletin does not say whether single-tenant setups are affected, so upgrade anyway.","fix":"Upgrade IBM API Connect 10.0.8.x to 10.0.8.13, or 12.1.x to 12.1.1.3 (via IBM Fix Central). IBM lists no workarounds or mitigations.","status":"open","published_at":"2026-11-07T05:18:47+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","triaged_at":"2026-11-07T05:50:24+00:00","updated_at":"2026-11-07T06:13:12+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:50:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: cross-tenant authentication bypass by authenticated users","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not isolate authentication checks between tenants. A logged-in user from one tenant can be accepted by another tenant, which can expose that tenant's resources.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","multi-tenant","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user from one tenant accesses another tenant's resources","analyst_note":"Check the IBM security bulletin for this CVE for fixed versions and whether single-tenant deployments are affected; the NVD entry alone gives no fix.","how_to_check":"- Check the installed API Connect version against `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2`\n- Confirm whether the deployment uses multiple tenants or organizations on a shared instance","plain_action":"","needs_analyst":true,"not_affected_if":["outside-affected-versions","single-tenant-deployment"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges with more than one tenant sharing an instance. The sources do not say whether single-tenant deployments are affected. The attacker must already hold an account in some tenant on the same system.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000717,"input_tokens":4265,"output_tokens":581,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for this CVE for fixed versions and whether single-tenant deployments are affected; the NVD entry alone gives no fix.","search":"'-17358':14A,17A '-2026':13A,16A '10.0.8.0':41B,79C '10.0.8.12':43B,81C '12.1.0.0':45B,83C '12.1.1.2':47B,85C 'accept':65B,119C 'across':95C 'allow':87C,111C 'anoth':67B,121C 'api':2A,19A,22A,27B,31B,38B,77C 'api-gateway':26B 'attack':91C 'authent':7A,10A,51B,90C,94C,100C,101C 'bypass':8A,93C 'check':52B,102C 'connect':3A,20A,23A,32B,39B,78C 'could':86C,110C 'cross':5A 'cross-ten':4A 'cve':12A,15A 'due':97C 'expos':71B 'gateway':28B 'ibm':1A,18A,21A,30B,37B,76C 'ibm-api-connect':29B 'improp':99C 'infrastructur':33B 'isol':50B,106C 'log':57B 'logged-in':56B 'multi':35B 'multi-ten':34B 'one':61B,115C 'onprem':25A 'remot':89C 'resourc':75B 'suffici':105C 'tenant':6A,36B,54B,62B,68B,73B,96C,108C,116C 'user':11A,59B,113C 'v12':24A 'version':40B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges with more than one tenant sharing an instance. The sources do not say whether single-tenant deployments are affected. The attacker must already hold an account in some tenant on the same system.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:13:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2026},"products":{"at":"2026-11-07T06:13:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2026},"mitigations":{"at":"2026-11-07T06:13:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2026},"workarounds":{"at":"2026-11-07T06:13:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2026},"how_to_check":{"at":"2026-11-07T06:13:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2026}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","ibmapiconnect","ibmapiconnectv12onprem"],"ptokens":["api","connect","ibm","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","infrastructure","multitenant"],"campaign_type":null,"search_a":"'-17358':14A,17A '-2026':13A,16A 'api':2A,19A,22A 'authent':7A,10A 'bypass':8A 'connect':3A,20A,23A 'cross':5A 'cross-ten':4A 'cve':12A,15A 'ibm':1A,18A,21A 'onprem':25A 'tenant':6A 'user':11A 'v12':24A","search_b":"'10.0.8.0':41B '10.0.8.12':43B '12.1.0.0':45B '12.1.1.2':47B 'accept':65B 'anoth':67B 'api':27B,31B,38B 'api-gateway':26B 'authent':51B 'check':52B 'connect':32B,39B 'expos':71B 'gateway':28B 'ibm':30B,37B 'ibm-api-connect':29B 'infrastructur':33B 'isol':50B 'log':57B 'logged-in':56B 'multi':35B 'multi-ten':34B 'one':61B 'resourc':75B 'tenant':36B,54B,62B,68B,73B 'user':59B 'version':40B","search_c":"'10.0.8.0':79C '10.0.8.12':81C '12.1.0.0':83C '12.1.1.2':85C 'accept':119C 'across':95C 'allow':87C,111C 'anoth':121C 'api':77C 'attack':91C 'authent':90C,94C,100C,101C 'bypass':93C 'check':102C 'connect':78C 'could':86C,110C 'due':97C 'ibm':76C 'improp':99C 'isol':106C 'one':115C 'remot':89C 'suffici':105C 'tenant':96C,108C,116C 'user':113C","first_public_at":"2026-11-07T05:18:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17358","severity":null,"published_at":"2026-11-07T05:18:47+00:00","modified_at":"2026-11-07T05:18:47+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","fetched_at":"2026-11-07T05:46:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17358:2026","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:13:12+00:00","modified_at":"2026-11-07T06:13:12+00:00","first_seen_at":"2026-11-07T06:13:12+00:00","fetched_at":"2026-11-07T06:13:12+00:00","note":"IBM bulletins (10.0.8.13 and v12.1.1.3) list CVE-2026-17358, CVSS 8.2, fix versions, no workarounds. Single-tenant exposure not stated by IBM. node/7295637 duplicates the -41 bulletin. No exploitation/PoC in sources; social not searched.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}