---
id: "CVE-2026-17375"
page: "https://infrastack.ai/live/CVE-2026-17375"
kind: "vulnerability"
aliases: ["CVE-2026-17375"]
title: "IBM API Connect: logged-in users can read data they should not see (CVE-2026-17375)"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "IBM API Connect", "fixed": ["10.0.8.13"], "affected": ">= 10.0.8.0, <= 10.0.8.12", "ecosystem": "vendor"}, {"name": "IBM API Connect V12", "fixed": ["12.1.1.3"], "affected": ">= 12.1.0.0, <= 12.1.1.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "ibm-api-connect", "infrastructure", "self-hosted"]
not_affected_if: ["fixed-version", "no-authenticated-users", "version-outside-range"]
published_at: "2026-11-07T05:18:50+00:00"
first_seen_at: "2026-11-07T05:46:06+00:00"
updated_at: "2026-11-07T06:11:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17375", "first_seen_at": "2026-11-07T05:46:06+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41", "first_seen_at": "2026-11-07T06:11:01+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41", "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}]
exploit_sources: []
---

# IBM API Connect: logged-in users can read data they should not see (CVE-2026-17375)

Link for people: https://infrastack.ai/live/CVE-2026-17375 (this .md is for agents)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 decide access using information supplied by the client. A logged-in attacker can use this to read information they should not be allowed to see.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM API Connect affected >= 10.0.8.0, <= 10.0.8.12 fixed 10.0.8.13
- vendor:IBM API Connect V12 affected >= 12.1.0.0, <= 12.1.1.2 fixed 12.1.1.3

## How to check

Check your API Connect version. Exposed if it is 10.0.8.0 through 10.0.8.12 or 12.1.0.0 through 12.1.1.2 (self-hosted). Fixed in 10.0.8.13 and 12.1.1.3. Any authenticated account can reach it, so review who holds accounts on the manager.

## Fix

Upgrade API Connect 10.0.8.x to 10.0.8.13; upgrade 12.1.x to 12.1.1.3 (IBM Fix Central). IBM lists no workaround.

## Timeline

- 2026-11-07T05:46:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17375
- 2026-11-07T06:11:01+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41 — Read IBM bulletins -41 (10.0.8.13; table lists 10.0.8.0-12, metadata says up to .13) and -39 (v12.1.1.3; no affected table, 12.1.1.3 fix from summary; 12.1.0.0-12.1.1.2 range from NVD). CVSS 7.7, CWE-639, no workaround, endpoints not named. Exploitation/PoC/chatter not checked.

## Documents

- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41
- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39

## From the sources

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization decisions rely on information supplied by the client, which could allow access to information the user should not see.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_