{"id":"CVE-2026-17379","kind":"vulnerability","aliases":["CVE-2026-17379"],"related":[],"title":"IBM API Connect: remote attacker bypasses authentication and assigns roles","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and assign arbitrary roles due to improper verification of cryptographic signatures.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not properly verify cryptographic signatures. A remote attacker can bypass authentication and assign themselves arbitrary roles.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["version-outside-range"],"how_to_check":"Check your API Connect version (management, gateway, portal, analytics subsystems). Exposed if it is 10.0.8.0 to 10.0.8.12 or 12.1.0.0 to 12.1.1.2 (IBM lists V12 OnPrem for the 12.x range). Fixed at 10.0.8.13 or 12.1.1.3 and later.","fix":"Upgrade to 10.0.8.13 (10.0.8.x line) or v12.1.1.3 (v12 line). IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:51+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","triaged_at":"2026-11-07T05:52:11+00:00","updated_at":"2026-11-07T06:10:14+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:52:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: remote attacker bypasses authentication and assigns roles","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not properly verify cryptographic signatures. A remote attacker can bypass authentication and assign themselves arbitrary roles.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker gains authentication bypass and arbitrary role assignment","analyst_note":"Find IBM's security bulletin for CVE-2026-17379 to confirm the fixed versions and any configuration conditions.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running IBM API Connect in the affected version ranges are exposed, since the flaw is reachable remotely without credentials. The sources do not describe a non-default configuration requirement. Installations outside the listed ranges are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":4235,"output_tokens":532,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17379 to confirm the fixed versions and any configuration conditions.","search":"'-17379':13A,16A '-2026':12A,15A '10.0.8.0':38B,65C '10.0.8.12':40B,67C '12.1.0.0':42B,69C '12.1.1.2':44B,71C 'allow':73C 'api':2A,17A,19A,24B,28B,35B,63C 'api-gateway':23B 'arbitrari':60B,82C 'assign':9A,58B,81C 'attack':5A,53B,76C 'authent':7A,56B,79C 'bypass':6A,55B,78C 'connect':3A,18A,20A,29B,36B,64C 'could':72C 'cryptograph':49B,89C 'cve':11A,14A 'due':84C 'gateway':25B 'host':32B 'ibm':1A,27B,34B,62C 'ibm-api-connect':26B 'improp':86C 'onprem':22A 'proper':47B 'remot':4A,52B,75C 'role':10A,61B,83C 'self':31B 'self-host':30B 'signatur':50B,90C 'v12':21A 'vendor':33B 'verif':87C 'verifi':48B 'version':37B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0 to 10.0.8.12 or v12 OnPrem 12.1.0.0 to 12.1.1.2. An unauthenticated remote attacker can bypass authentication and assign arbitrary roles because cryptographic signatures are not verified properly; IBM rates it high (7.4) with high attack complexity. IBM lists no configuration condition and no workaround. Installs already on 10.0.8.13 or 12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:10:14Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":2018},"products":{"at":"2026-11-07T06:10:14Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":2018},"workarounds":{"at":"2026-11-07T06:10:14Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":2018},"how_to_check":{"at":"2026-11-07T06:10:14Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":2018},"who_affected":{"at":"2026-11-07T06:10:14Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":2018}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","connect","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17379':13A,16A '-2026':12A,15A 'api':2A,17A,19A 'assign':9A 'attack':5A 'authent':7A 'bypass':6A 'connect':3A,18A,20A 'cve':11A,14A 'ibm':1A 'onprem':22A 'remot':4A 'role':10A 'v12':21A","search_b":"'10.0.8.0':38B '10.0.8.12':40B '12.1.0.0':42B '12.1.1.2':44B 'api':24B,28B,35B 'api-gateway':23B 'arbitrari':60B 'assign':58B 'attack':53B 'authent':56B 'bypass':55B 'connect':29B,36B 'cryptograph':49B 'gateway':25B 'host':32B 'ibm':27B,34B 'ibm-api-connect':26B 'proper':47B 'remot':52B 'role':61B 'self':31B 'self-host':30B 'signatur':50B 'vendor':33B 'verifi':48B 'version':37B","search_c":"'10.0.8.0':65C '10.0.8.12':67C '12.1.0.0':69C '12.1.1.2':71C 'allow':73C 'api':63C 'arbitrari':82C 'assign':81C 'attack':76C 'authent':79C 'bypass':78C 'connect':64C 'could':72C 'cryptograph':89C 'due':84C 'ibm':62C 'improp':86C 'remot':75C 'role':83C 'signatur':90C 'verif':87C","first_public_at":"2026-11-07T05:18:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17379","severity":null,"published_at":"2026-11-07T05:18:51+00:00","modified_at":"2026-11-07T05:18:51+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","fetched_at":"2026-11-07T05:46:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17379:2018","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:10:14+00:00","modified_at":"2026-11-07T06:10:14+00:00","first_seen_at":"2026-11-07T06:10:14+00:00","fetched_at":"2026-11-07T06:10:14+00:00","note":"Read IBM's two bulletins (-39 for v12 OnPrem, -41 for 10.0.8); both list CVE-2026-17379, CVSS 7.4, workarounds None. No exploitation or PoC checked beyond bulletin.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/node/7290205"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93155,"url":"https://www.ibm.com/support/pages/node/7290205","title":"IBM API Connect v12.1.1.3 is now available","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}