{"id":"CVE-2026-17390","kind":"vulnerability","aliases":["CVE-2026-17390"],"related":[],"title":"IBM API Connect: authenticated users can run scripts in the web UI","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have a cross-site scripting flaw in the web UI. An authenticated user can make the page run arbitrary JavaScript, which could alter the page and expose credentials within a trusted session.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed API Connect version against `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2`.","fix":null,"status":"open","published_at":"2026-11-07T05:18:53+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","triaged_at":"2026-11-07T05:52:36+00:00","updated_at":"2026-11-07T05:52:36+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:52:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can run scripts in the web UI","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have a cross-site scripting flaw in the web UI. An authenticated user can make the page run arbitrary JavaScript, which could alter the page and expose credentials within a trusted session.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Script runs in users' sessions; credentials may be disclosed","analyst_note":"Confirm the fixed version and any IBM bulletin for API Connect 10.0.8.x and 12.1.x from the IBM security advisory; the NVD entry gives no fix.","how_to_check":"- Check the installed API Connect version against `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2`.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where users with login access to the management web UI could exploit the flaw. The sources do not say which deployment modes or roles are most exposed. Teams on other versions or without the web UI exposed can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000714,"input_tokens":4261,"output_tokens":575,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17390':15A,18A '-2026':14A,17A '10.0.8.0':31B,74C '10.0.8.12':33B,76C '12.1.0.0':35B,78C '12.1.1.2':37B,80C 'allow':82C 'alter':61B,102C 'api':2A,20B,24B,28B,72C 'api-gateway':19B 'arbitrari':57B,88C 'authent':4A,50B,84C 'connect':3A,25B,29B,73C 'could':60B,81C,101C 'credenti':66B,113C 'cross':41B,97C 'cross-sit':40B,96C 'cve':13A,16A 'disclosur':114C 'due':94C 'execut':87C 'expos':65B 'flaw':44B 'function':105C 'gateway':21B 'ibm':1A,23B,27B,71C 'ibm-api-connect':22B 'intend':104C 'javascript':58B,89C 'lead':111C 'make':53B 'page':55B,63B,108C 'potenti':110C 'run':7A,56B 'script':8A,43B,99C 'session':70B,118C 'site':42B,98C 'trust':69B,117C 'ui':12A,48B,93C 'user':5A,51B,85C 'vendor':26B 'version':30B 'web':11A,47B,92C 'within':67B,115C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges, where users with login access to the management web UI could exploit the flaw. The sources do not say which deployment modes or roles are most exposed. Teams on other versions or without the web UI exposed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","medium","vendor"],"campaign_type":null,"search_a":"'-17390':15A,18A '-2026':14A,17A 'api':2A 'authent':4A 'connect':3A 'cve':13A,16A 'ibm':1A 'run':7A 'script':8A 'ui':12A 'user':5A 'web':11A","search_b":"'10.0.8.0':31B '10.0.8.12':33B '12.1.0.0':35B '12.1.1.2':37B 'alter':61B 'api':20B,24B,28B 'api-gateway':19B 'arbitrari':57B 'authent':50B 'connect':25B,29B 'could':60B 'credenti':66B 'cross':41B 'cross-sit':40B 'expos':65B 'flaw':44B 'gateway':21B 'ibm':23B,27B 'ibm-api-connect':22B 'javascript':58B 'make':53B 'page':55B,63B 'run':56B 'script':43B 'session':70B 'site':42B 'trust':69B 'ui':48B 'user':51B 'vendor':26B 'version':30B 'web':47B 'within':67B","search_c":"'10.0.8.0':74C '10.0.8.12':76C '12.1.0.0':78C '12.1.1.2':80C 'allow':82C 'alter':102C 'api':72C 'arbitrari':88C 'authent':84C 'connect':73C 'could':81C,101C 'credenti':113C 'cross':97C 'cross-sit':96C 'disclosur':114C 'due':94C 'execut':87C 'function':105C 'ibm':71C 'intend':104C 'javascript':89C 'lead':111C 'page':108C 'potenti':110C 'script':99C 'session':118C 'site':98C 'trust':117C 'ui':93C 'user':85C 'web':92C 'within':115C","first_public_at":"2026-11-07T05:18:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17390","severity":null,"published_at":"2026-11-07T05:18:53+00:00","modified_at":"2026-11-07T05:18:53+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","fetched_at":"2026-11-07T05:46:07+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}