{"id":"CVE-2026-17392","kind":"vulnerability","aliases":["CVE-2026-17392"],"related":[],"title":"IBM API Connect: LDAP injection grants admin access to other tenants","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not neutralize user input in LDAP directory queries. A logged-in attacker can alter those queries and gain administrative access to other tenants.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-api-connect","ldap","multi-tenant","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Check your API Connect version. IBM's bulletin lists V10.0.8.0 through V10.0.8.12 as affected; 10.0.8.13 is the fix.\n- NVD also lists 12.1.0.0 through 12.1.1.2. IBM's bulletin does not list 12.1, so treat 12.1.x as possibly affected and ask IBM or check Fix Central for 12.1.1.3.\n- The bulletin does not say LDAP must be configured. The flaw is in LDAP directory queries, so check whether any user registry or sign-in uses LDAP.","fix":"Upgrade API Connect 10.0.8.x to 10.0.8.13 (IBM bulletin). For 12.1.x, IBM's bulletin for this CVE does not list 12.1; v12.1.1.3 exists but its release page names no CVEs, so whether it fixes this is unconfirmed.","status":"open","published_at":"2026-11-07T05:18:54+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","triaged_at":"2026-11-07T05:48:00+00:00","updated_at":"2026-11-07T05:48:54+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-07T05:48:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: LDAP injection grants admin access to other tenants","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not neutralize user input in LDAP directory queries. A logged-in attacker can alter those queries and gain administrative access to other tenants.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","ldap","multi-tenant","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker gains administrative access to other tenants' API Connect data","analyst_note":"Check IBM's security bulletin for CVE-2026-17392 for the fixed version and whether LDAP configuration is required to be exposed.","how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- Confirm whether the deployment uses LDAP for user authentication.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running IBM API Connect in the affected version ranges, especially multi-tenant deployments where LDAP handles user sign-in. The sources do not state whether single-tenant or non-LDAP setups are exposed, so treat them as unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000709,"input_tokens":4273,"output_tokens":564,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for CVE-2026-17392 for the fixed version and whether LDAP configuration is required to be exposed.","search":"'-17392':14A,17A '-2026':13A,16A '10.0.8.0':36B,71C '10.0.8.12':38B,73C '12.1.0.0':40B,75C '12.1.1.2':42B,77C 'access':8A,64B,88C,114C 'admin':7A 'administr':63B,87C 'allow':79C 'alter':58B 'api':2A,18A,22B,33B,69C 'attack':56B,83C 'authent':82C 'beyond':115C 'chang':109C 'connect':3A,19A,23B,34B,70C 'could':78C,108C 'cve':12A,15A 'directori':50B,105C 'due':92C 'gain':62B,85C 'grant':6A,113C 'host':30B 'ibm':1A,21B,32B,68C 'ibm-api-connect':20B 'inject':5A,95C 'input':47B,99C 'ldap':4A,24B,49B,94C 'log':54B 'logged-in':53B 'multi':26B 'multi-ten':25B 'neutral':45B,103C 'proper':102C 'queri':51B,60B,106C,111C 'remot':81C 'self':29B 'self-host':28B 'suppli':98C 'tenant':11A,27B,67B,91C,120C 'unauthor':86C 'user':46B,97C,117C 'user-suppli':96C 'vendor':31B 'version':35B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted IBM API Connect 10.0.8.0 through 10.0.8.12 (confirmed by IBM). Any logged-in user could reach administrative access in other tenants, so multi-tenant setups matter most. NVD also lists 12.1.0.0 through 12.1.1.2, but IBM's bulletin does not confirm 12.1. Whether non-LDAP setups are exposed is not stated.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:48:54Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1959},"workarounds":{"at":"2026-11-07T05:48:54Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1959}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","connect"],"ptokens":["api","connect"],"labels":["critical","ibmapiconnect","ldap","multitenant","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17392':14A,17A '-2026':13A,16A 'access':8A 'admin':7A 'api':2A,18A 'connect':3A,19A 'cve':12A,15A 'grant':6A 'ibm':1A 'inject':5A 'ldap':4A 'tenant':11A","search_b":"'10.0.8.0':36B '10.0.8.12':38B '12.1.0.0':40B '12.1.1.2':42B 'access':64B 'administr':63B 'alter':58B 'api':22B,33B 'attack':56B 'connect':23B,34B 'directori':50B 'gain':62B 'host':30B 'ibm':21B,32B 'ibm-api-connect':20B 'input':47B 'ldap':24B,49B 'log':54B 'logged-in':53B 'multi':26B 'multi-ten':25B 'neutral':45B 'queri':51B,60B 'self':29B 'self-host':28B 'tenant':27B,67B 'user':46B 'vendor':31B 'version':35B","search_c":"'10.0.8.0':71C '10.0.8.12':73C '12.1.0.0':75C '12.1.1.2':77C 'access':88C,114C 'administr':87C 'allow':79C 'api':69C 'attack':83C 'authent':82C 'beyond':115C 'chang':109C 'connect':70C 'could':78C,108C 'directori':105C 'due':92C 'gain':85C 'grant':113C 'ibm':68C 'inject':95C 'input':99C 'ldap':94C 'neutral':103C 'proper':102C 'queri':106C,111C 'remot':81C 'suppli':98C 'tenant':91C,120C 'unauthor':86C 'user':97C,117C 'user-suppli':96C","first_public_at":"2026-11-07T05:18:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17392","severity":null,"published_at":"2026-11-07T05:18:54+00:00","modified_at":"2026-11-07T05:18:54+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","fetched_at":"2026-11-07T05:46:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17392:1959","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T05:48:54+00:00","modified_at":"2026-11-07T05:48:54+00:00","first_seen_at":"2026-11-07T05:48:54+00:00","fetched_at":"2026-11-07T05:48:54+00:00","note":"IBM bulletin (-41) read: affects V10.0.8.0-10.0.8.12, fix 10.0.8.13, workarounds/mitigations: None. 12.1 range comes from NVD only; v12.1.1.3 page lists no CVEs, so 12.1 fix unconfirmed. No exploitation or PoC found.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/node/7290205"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93155,"url":"https://www.ibm.com/support/pages/node/7290205","title":"IBM API Connect v12.1.1.3 is now available","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}