API CONNECT · CVE-2026-17394 · Vendor
FIX → 10.0.8.13 · 12.1.1.3 ✓ verified
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 let a logged-in user supply a value that changes an access-related setting the system should control. An attacker can use this to read sensitive information they should not see.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run IBM API Connect themselves (on-premises or self-managed) on 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2. Any logged-in user can supply a value that changes an access-related setting the system should control, which can expose sensitive information; IBM rates it 9.6 with scope change. Teams on 10.0.8.13 or 12.1.1.3 and later can skip it; IBM's bulletins list no workaround, so upgrading is the only listed remedy.
Not affected if unknown
Who cares api-gateway, auth-required, ibm-api-connect, self-hosted
10.0.8.0 through 10.0.8.12, or through (V12 OnPrem). and or later are fixedIBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
12.1.0.012.1.1.210.0.8.1312.1.1.3Upgrade to 10.0.8.13 · 12.1.1.3
10.0.8.x to 10.0.8.13, and 12.1.x to 12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205 for 12.1.1.3)NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.