{"id":"CVE-2026-17382","kind":"vulnerability","aliases":["CVE-2026-17382"],"related":[],"title":"IBM API Connect: path traversal lets authenticated users read sensitive files","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal flaw. A logged-in remote attacker can use it to obtain sensitive information.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-connect","auth-required","ibm","path-traversal","self-hosted","vendor"],"not_affected_if":["auth-required","unaffected-version"],"how_to_check":"Check your API Connect version. Per IBM's bulletin, 10.0.8.0 through 10.0.8.12 are affected; upgrade to 10.0.8.13. NVD/CVE record also lists 12.1.0.0 through 12.1.1.2, but IBM's bulletin does not list 12.1.x or a fix for it, so if you run 12.1.x, ask IBM support or check IBM's 12.1 bulletins.","fix":"Upgrade IBM API Connect to 10.0.8.13 (IBM bulletin; download via Fix Central). IBM's bulletin names no fixed version for 12.1.x.","status":"open","published_at":"2026-11-07T05:18:52+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","triaged_at":"2026-11-07T05:50:00+00:00","updated_at":"2026-11-07T06:08:53+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-07T05:50:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: path traversal lets authenticated users read sensitive files","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal flaw. A logged-in remote attacker can use it to obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm","api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker reads sensitive files on the server","analyst_note":"Check IBM's security bulletin for API Connect and confirm the fixed versions and any required configuration; the NVD entry alone gives no fix or check steps.","how_to_check":"- Check the installed API Connect version against the affected ranges: `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where an attacker has a valid account. The sources do not say which deployment settings or features are required, so unknown whether default configurations are exposed. Teams on other versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000691,"input_tokens":4228,"output_tokens":537,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for API Connect and confirm the fixed versions and any required configuration; the NVD entry alone gives no fix or check steps.","search":"'-17382':14A,17A '-2026':13A,16A '10.0.8.0':39B,67C '10.0.8.12':41B,69C '12.1.0.0':43B,71C '12.1.1.2':45B,73C 'allow':75C 'api':2A,19A,22B,36B,65C 'api-connect':18A,21B 'attack':56B,79C 'auth':25B 'auth-requir':24B 'authent':7A,78C 'connect':3A,20A,23B,37B,66C 'contain':46B 'could':74C 'cve':12A,15A 'due':84C 'file':11A 'flaw':50B 'host':33B 'ibm':1A,27B,35B,64C 'inform':63B,83C 'let':6A 'log':53B 'logged-in':52B 'obtain':61B,81C 'path':4A,29B,48B,87C 'path-travers':28B 'read':9A 'remot':55B,77C 'requir':26B 'self':32B 'self-host':31B 'sensit':10A,62B,82C 'travers':5A,30B,49B,88C 'use':58B 'user':8A 'vendor':34B 'version':38B 'vulner':89C","nicknames":[],"mitigations":[],"who_affected":"Self-managed IBM API Connect deployments on 10.0.8.0 through 10.0.8.12 are affected. An attacker needs a valid login, then can use a path traversal to read sensitive information. Teams not running API Connect, or running 10.0.8.13 or later, can skip it. 12.1.x is listed in the CVE record but not in IBM's bulletin.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:08:53Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2015},"how_to_check":{"at":"2026-11-07T06:08:53Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2015}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect"],"ptokens":["api","connect"],"labels":["apiconnect","authrequired","high","ibm","pathtraversal","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17382':14A,17A '-2026':13A,16A 'api':2A,19A 'api-connect':18A 'authent':7A 'connect':3A,20A 'cve':12A,15A 'file':11A 'ibm':1A 'let':6A 'path':4A 'read':9A 'sensit':10A 'travers':5A 'user':8A","search_b":"'10.0.8.0':39B '10.0.8.12':41B '12.1.0.0':43B '12.1.1.2':45B 'api':22B,36B 'api-connect':21B 'attack':56B 'auth':25B 'auth-requir':24B 'connect':23B,37B 'contain':46B 'flaw':50B 'host':33B 'ibm':27B,35B 'inform':63B 'log':53B 'logged-in':52B 'obtain':61B 'path':29B,48B 'path-travers':28B 'remot':55B 'requir':26B 'self':32B 'self-host':31B 'sensit':62B 'travers':30B,49B 'use':58B 'vendor':34B 'version':38B","search_c":"'10.0.8.0':67C '10.0.8.12':69C '12.1.0.0':71C '12.1.1.2':73C 'allow':75C 'api':65C 'attack':79C 'authent':78C 'connect':66C 'could':74C 'due':84C 'ibm':64C 'inform':83C 'obtain':81C 'path':87C 'remot':77C 'sensit':82C 'travers':88C 'vulner':89C","first_public_at":"2026-11-07T05:18:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17382","severity":null,"published_at":"2026-11-07T05:18:52+00:00","modified_at":"2026-11-07T05:18:52+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","fetched_at":"2026-11-07T05:46:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17382:2015","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:08:53+00:00","modified_at":"2026-11-07T06:08:53+00:00","first_seen_at":"2026-11-07T06:08:53+00:00","fetched_at":"2026-11-07T06:08:53+00:00","note":"IBM bulletin (-41) lists CVE-2026-17382 CWE-22, CVSS 8.5, affected 10.0.8.0-10.0.8.12, fix 10.0.8.13; no workarounds listed. 12.1.0.0-12.1.1.2 appears in CVE record but not in bulletin; left 12.1 unconfirmed. No exploitation or PoC found; no social search done.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}