{"id":"CVE-2026-17400","kind":"vulnerability","aliases":["CVE-2026-17400"],"related":[],"title":"IBM API Connect: SQL injection lets an authenticated user read sensitive data","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection flaw. A remote attacker with a valid account can use it to obtain sensitive information from the backend database.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"IBM API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","sql-injection","vendor"],"not_affected_if":["patched-version","unknown"],"how_to_check":"Check your installed IBM API Connect version. Affected: 10.0.8.0 through 10.0.8.12, and V12 OnPrem 12.1.0.0 through 12.1.1.2. Fixed: 10.0.8.13 and 12.1.1.3.","fix":"Upgrade IBM API Connect 10.0.8.x to 10.0.8.13, or V12 OnPrem 12.1.x to v12.1.1.3 (via IBM Fix Central; V12 fix page https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:56+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","triaged_at":"2026-11-07T05:50:33+00:00","updated_at":"2026-11-07T06:06:52+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:50:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: SQL injection lets an authenticated user read sensitive data","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection flaw. A remote attacker with a valid account can use it to obtain sensitive information from the backend database.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker reads sensitive data from the database","analyst_note":"Check the IBM security bulletin for this CVE to confirm the fixed versions and any workaround; the NVD entry alone does not state a fix.","how_to_check":"- Confirm the installed IBM API Connect version and compare it with the affected ranges `10.0.8.0` to `10.0.8.12` and `12.1.0.0` to `12.1.1.2`.\n- unknown for other checks: the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges are exposed to a remote attacker who already has an account. The sources do not say which features or configurations are needed to reach the vulnerable code path. Deployments outside the listed version ranges are not affected according to the NVD entry.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000704,"input_tokens":4223,"output_tokens":564,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for this CVE to confirm the fixed versions and any workaround; the NVD entry alone does not state a fix.","search":"'-17400':15A,18A '-2026':14A,17A '10.0.8.0':45B,78C '10.0.8.12':47B,80C '12.1.0.0':49B,82C '12.1.1.2':51B,84C 'account':63B 'allow':86C 'api':2A,20A,23A,28B,32B,42B,76C 'api-gateway':27B 'attack':59B,90C 'authent':8A,89C 'backend':73B 'connect':3A,21A,24A,33B,43B,77C 'contain':52B 'could':85C 'cve':13A,16A 'data':12A 'databas':74B 'due':95C 'flaw':56B 'gateway':29B 'host':36B 'ibm':1A,19A,22A,31B,41B,75C 'ibm-api-connect':30B 'inform':70B,94C 'inject':5A,39B,55B,98C 'let':6A 'obtain':68B,92C 'onprem':26A 'read':10A 'remot':58B,88C 'self':35B 'self-host':34B 'sensit':11A,69B,93C 'sql':4A,38B,54B,97C 'sql-inject':37B 'use':65B 'user':9A 'v12':25A 'valid':62B 'vendor':40B 'version':44B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect 10.0.8.0-10.0.8.12 or API Connect V12 OnPrem 12.1.0.0-12.1.1.2. The attacker needs a valid account (low privileges), then can read sensitive data from the backend database through SQL injection. Anyone on 10.0.8.13 / 12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:06:52Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2008},"products":{"at":"2026-11-07T06:06:52Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2008},"workarounds":{"at":"2026-11-07T06:06:52Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2008},"how_to_check":{"at":"2026-11-07T06:06:52Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2008},"who_affected":{"at":"2026-11-07T06:06:52Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2008}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","ibmapiconnect","ibmapiconnectv12onprem"],"ptokens":["api","connect","ibm","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","selfhosted","sqlinjection","vendor"],"campaign_type":null,"search_a":"'-17400':15A,18A '-2026':14A,17A 'api':2A,20A,23A 'authent':8A 'connect':3A,21A,24A 'cve':13A,16A 'data':12A 'ibm':1A,19A,22A 'inject':5A 'let':6A 'onprem':26A 'read':10A 'sensit':11A 'sql':4A 'user':9A 'v12':25A","search_b":"'10.0.8.0':45B '10.0.8.12':47B '12.1.0.0':49B '12.1.1.2':51B 'account':63B 'api':28B,32B,42B 'api-gateway':27B 'attack':59B 'backend':73B 'connect':33B,43B 'contain':52B 'databas':74B 'flaw':56B 'gateway':29B 'host':36B 'ibm':31B,41B 'ibm-api-connect':30B 'inform':70B 'inject':39B,55B 'obtain':68B 'remot':58B 'self':35B 'self-host':34B 'sensit':69B 'sql':38B,54B 'sql-inject':37B 'use':65B 'valid':62B 'vendor':40B 'version':44B","search_c":"'10.0.8.0':78C '10.0.8.12':80C '12.1.0.0':82C '12.1.1.2':84C 'allow':86C 'api':76C 'attack':90C 'authent':89C 'connect':77C 'could':85C 'due':95C 'ibm':75C 'inform':94C 'inject':98C 'obtain':92C 'remot':88C 'sensit':93C 'sql':97C","first_public_at":"2026-11-07T05:18:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17400","severity":null,"published_at":"2026-11-07T05:18:56+00:00","modified_at":"2026-11-07T05:18:56+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","fetched_at":"2026-11-07T05:46:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17400:2008","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:06:52+00:00","modified_at":"2026-11-07T06:06:52+00:00","first_seen_at":"2026-11-07T06:06:52+00:00","fetched_at":"2026-11-07T06:06:52+00:00","note":"Read both IBM bulletins (…api-connect-41 for 10.0.8.x, …api-connect-39 for V12 OnPrem). CWE-89, CVSS 7.7; fix 10.0.8.13 / v12.1.1.3; workarounds: none. No exploitation or PoC seen (not searched on X; low-profile).","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}