API CONNECT · CVE-2026-17392 · Vendor
FIX → 10.0.8.13 ✓ verified
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not neutralize user input in LDAP directory queries. A logged-in attacker can alter those queries and gain administrative access to other tenants.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted IBM API Connect 10.0.8.0 through 10.0.8.12 (confirmed by IBM). Any logged-in user could reach administrative access in other tenants, so multi-tenant setups matter most. NVD also lists 12.1.0.0 through 12.1.1.2, but IBM's bulletin does not confirm 12.1. Whether non-LDAP setups are exposed is not stated.
Not affected if unknown
Who cares ibm-api-connect, ldap, multi-tenant, self-hosted
Upgrade to 10.0.8.13
10.0.8.x to (IBM bulletin)IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
10.0.8.13v12.1.1.3 exists but its release page names no CVEs, so whether it fixes this is unconfirmed