API CONNECT · CVE-2026-17409 · Infrastructure
FIX → 10.0.8.13 · 12.1.1.3 ✓ verified
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 apply access controls inconsistently across variations of a request, because of case-sensitivity handling. A remote attacker can reach restricted administrative operations and obtain sensitive information.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone running self-managed IBM API Connect 10.0.8.0 to 10.0.8.12 or 12.1.0.0 to 12.1.1.2 is exposed. IBM's CVSS vector says a remote attacker needs no login (network, low complexity, no privileges), so any instance whose endpoints can be reached over the network is at risk. Teams on 10.0.8.13, 12.1.1.3 or later can skip it.
Not affected if unaffected-version
Who cares api-gateway, ibm-api-connect, self-hosted
10.0.8.0 through 10.0.8.12 or 12.1.0.0 through 12.1.1.2; 10.0.8.13 and 12.1.1.3 or later are fixedIBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
This page as .md ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 10.0.8.13 · 12.1.1.3
10.0.8.13 (for 10.0.8.0-10.0.8.12) or 12.1.1.3 (for 12.1.0.0-12.1.1.2), downloaded from IBM Fix CentralNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.