{"id":"CVE-2026-17381","kind":"vulnerability","aliases":["CVE-2026-17381"],"related":[],"title":"IBM API Connect: authorization flaw lets a logged-in user read sensitive data","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to validate authorization properly when user-controlled keys are used. A remote attacker with a valid account can obtain sensitive information.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"IBM API Connect","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","authenticated","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["fixed-version","version-outside-range"],"how_to_check":"Check your API Connect version. Exposed if it is 10.0.8.0 through 10.0.8.12 or 12.1.0.0 through 12.1.1.2 (self-hosted/on-prem). Fixed in 10.0.8.13 and 12.1.1.3. Any authenticated account can reach it, so review who holds accounts on the manager.","fix":"Upgrade API Connect 10.0.8.x to 10.0.8.13; upgrade 12.1.x (V12 OnPrem) to 12.1.1.3 (IBM Fix Central). IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:51+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","triaged_at":"2026-11-07T05:50:04+00:00","updated_at":"2026-11-07T06:08:59+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-07T05:50:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authorization flaw lets a logged-in user read sensitive data","impact":"low","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to validate authorization properly when user-controlled keys are used. A remote attacker with a valid account can obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads sensitive information they should not access","analyst_note":"Check the IBM security bulletin for this CVE to confirm the fixed versions and the affected endpoints; the NVD entry alone does not give a fix.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks: the sources do not say which endpoints or settings are involved.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where authenticated users can reach the API management services. The sources do not say which endpoints or configurations are involved, so the exact exposure is unknown. Installations outside the listed ranges are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000707,"input_tokens":4233,"output_tokens":568,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for this CVE to confirm the fixed versions and the affected endpoints; the NVD entry alone does not give a fix.","search":"'-17381':17A,20A '-2026':16A,19A '10.0.8.0':43B,76C '10.0.8.12':45B,78C '12.1.0.0':47B,80C '12.1.1.2':49B,82C 'account':68B 'allow':84C 'api':2A,22A,25A,28B,33B,40B,74C 'api-gateway':27B 'attack':64B,88C 'authent':30B,87C 'author':4A,53B,96C 'connect':3A,23A,26A,34B,41B,75C 'control':58B,101C 'could':83C 'cve':15A,18A 'data':14A 'due':93C 'fail':50B 'flaw':5A 'gateway':29B 'host':37B 'ibm':1A,21A,24A,32B,39B,73C 'ibm-api-connect':31B 'improp':95C 'inform':72B,92C 'key':59B,102C 'let':6A 'log':9A 'logged-in':8A 'obtain':70B,90C 'proper':54B 'read':12A 'remot':63B,86C 'self':36B 'self-host':35B 'sensit':13A,71B,91C 'use':61B,98C 'user':11A,57B,100C 'user-control':56B,99C 'valid':52B,67B,97C 'vendor':38B 'version':42B","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM API Connect themselves on 10.0.8.0 to 10.0.8.12 or 12.1.0.0 to 12.1.1.2. Any logged-in user could read sensitive data they should not see, because authorization is checked against user-controlled keys (CWE-639). Needs a valid account, no user interaction. IBM does not say which endpoints are involved. Versions 10.0.8.13 / 12.1.1.3 and later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:08:59Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2016},"products":{"at":"2026-11-07T06:08:59Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2016},"how_to_check":{"at":"2026-11-07T06:08:59Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2016},"who_affected":{"at":"2026-11-07T06:08:59Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2016}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","ibmapiconnect"],"ptokens":["api","connect","ibm"],"labels":["apigateway","authenticated","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17381':17A,20A '-2026':16A,19A 'api':2A,22A,25A 'author':4A 'connect':3A,23A,26A 'cve':15A,18A 'data':14A 'flaw':5A 'ibm':1A,21A,24A 'let':6A 'log':9A 'logged-in':8A 'read':12A 'sensit':13A 'user':11A","search_b":"'10.0.8.0':43B '10.0.8.12':45B '12.1.0.0':47B '12.1.1.2':49B 'account':68B 'api':28B,33B,40B 'api-gateway':27B 'attack':64B 'authent':30B 'author':53B 'connect':34B,41B 'control':58B 'fail':50B 'gateway':29B 'host':37B 'ibm':32B,39B 'ibm-api-connect':31B 'inform':72B 'key':59B 'obtain':70B 'proper':54B 'remot':63B 'self':36B 'self-host':35B 'sensit':71B 'use':61B 'user':57B 'user-control':56B 'valid':52B,67B 'vendor':38B 'version':42B","search_c":"'10.0.8.0':76C '10.0.8.12':78C '12.1.0.0':80C '12.1.1.2':82C 'allow':84C 'api':74C 'attack':88C 'authent':87C 'author':96C 'connect':75C 'control':101C 'could':83C 'due':93C 'ibm':73C 'improp':95C 'inform':92C 'key':102C 'obtain':90C 'remot':86C 'sensit':91C 'use':98C 'user':100C 'user-control':99C 'valid':97C","first_public_at":"2026-11-07T05:18:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17381","severity":null,"published_at":"2026-11-07T05:18:51+00:00","modified_at":"2026-11-07T05:18:52+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","fetched_at":"2026-11-07T05:46:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17381:2016","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:08:59+00:00","modified_at":"2026-11-07T06:08:59+00:00","first_seen_at":"2026-11-07T06:08:59+00:00","fetched_at":"2026-11-07T06:08:59+00:00","note":"Read IBM bulletins -41 (10.0.8.13) and -39 (v12.1.1.3): CVE listed, CWE-639, CVSS 8.5, workaround None. -41 page metadata says 10.0.8.13 affected but its table says 10.0.8.0-12. No exploitation/PoC checked beyond NVD/bulletin; endpoints not named.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}