{"id":"CVE-2026-17410","kind":"vulnerability","aliases":["CVE-2026-17410"],"related":[],"title":"IBM API Connect: authenticated attacker can reach other tenants' portal data","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.","summary":"IBM API Connect 10.0.8.0-10.0.8.12 and V12 OnPrem 12.1.0.0-12.1.1.2 do not neutralize argument delimiters (CWE-88). A remote authenticated user can access and modify other tenants' portal data. IBM fixed it in 10.0.8.13 and 12.1.1.3 and lists no workarounds.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","multi-tenant"],"not_affected_if":["single-tenant","versions-outside-range"],"how_to_check":"- Check the installed API Connect version: affected are 10.0.8.0 through 10.0.8.12 and V12 OnPrem 12.1.0.0 through 12.1.1.2.\n- Fixed releases are 10.0.8.13 and 12.1.1.3.\n- If you run multiple tenants/provider orgs on one developer portal, treat them as exposed until upgraded.","fix":"Upgrade API Connect 12.x (V12 OnPrem) to v12.1.1.3 and 10.0.8.x to 10.0.8.13 via IBM Fix Central. IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:58+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","triaged_at":"2026-11-07T05:48:00+00:00","updated_at":"2026-11-07T05:48:53+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-07T05:48:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: authenticated attacker can reach other tenants' portal data","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to neutralize argument delimiters. A remote attacker with a valid account can access and modify other tenants' portal data.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","multi-tenant"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads and modifies other tenants' portal data","analyst_note":"Find IBM's security bulletin for CVE-2026-17410 to confirm the fixed versions and any required setting.","how_to_check":"- Check the installed IBM API Connect version against `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2`\n- Confirm which tenants share the same portal deployment","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-range","single-tenant"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges with multiple tenants sharing a portal. The attacker must be an authenticated remote user. Single-tenant deployments and versions outside the listed ranges are not described as affected by the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000698,"input_tokens":4236,"output_tokens":549,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17410 to confirm the fixed versions and any required setting.","search":"'-17410':14A,17A '-2026':13A,16A '-88':51B '10.0.8.0':38B,78C '10.0.8.12':39B,80C '10.0.8.13':68B '12.1.0.0':43B,82C '12.1.1.2':44B,84C '12.1.1.3':70B 'access':57B,92C 'allow':86C 'api':2A,18A,20A,25B,29B,36B,76C 'api-gateway':24B 'argument':48B,104C 'attack':5A,90C 'authent':4A,54B,89C 'connect':3A,19A,21A,30B,37B,77C 'could':85C 'cve':12A,15A 'cwe':50B 'data':11A,63B,98C 'delimit':49B,105C 'due':99C 'fix':65B 'gateway':26B 'ibm':1A,28B,35B,64B,75C 'ibm-api-connect':27B 'improp':101C 'infrastructur':31B 'list':72B 'modifi':59B,94C 'multi':33B 'multi-ten':32B 'neutral':47B,102C 'onprem':23A,42B 'portal':10A,62B,97C 'reach':7A 'remot':53B,88C 'tenant':9A,34B,61B,96C 'user':55B 'v12':22A,41B 'workaround':74B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect 10.0.8.0-10.0.8.12 or V12 OnPrem 12.1.0.0-12.1.1.2 where any remote authenticated user can sign in; that user can read and change other tenants' portal data. Multi-tenant portal deployments are most at risk. Versions 10.0.8.13 / 12.1.1.3 and later can skip it; IBM names no other setting that avoids it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:48:53Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1956},"products":{"at":"2026-11-07T05:48:53Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1956},"mitigations":{"at":"2026-11-07T05:48:53Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1956},"workarounds":{"at":"2026-11-07T05:48:53Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1956},"how_to_check":{"at":"2026-11-07T05:48:53Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1956},"who_affected":{"at":"2026-11-07T05:48:53Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1956}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","connect","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","critical","ibmapiconnect","infrastructure","multitenant"],"campaign_type":null,"search_a":"'-17410':14A,17A '-2026':13A,16A 'api':2A,18A,20A 'attack':5A 'authent':4A 'connect':3A,19A,21A 'cve':12A,15A 'data':11A 'ibm':1A 'onprem':23A 'portal':10A 'reach':7A 'tenant':9A 'v12':22A","search_b":"'-88':51B '10.0.8.0':38B '10.0.8.12':39B '10.0.8.13':68B '12.1.0.0':43B '12.1.1.2':44B '12.1.1.3':70B 'access':57B 'api':25B,29B,36B 'api-gateway':24B 'argument':48B 'authent':54B 'connect':30B,37B 'cwe':50B 'data':63B 'delimit':49B 'fix':65B 'gateway':26B 'ibm':28B,35B,64B 'ibm-api-connect':27B 'infrastructur':31B 'list':72B 'modifi':59B 'multi':33B 'multi-ten':32B 'neutral':47B 'onprem':42B 'portal':62B 'remot':53B 'tenant':34B,61B 'user':55B 'v12':41B 'workaround':74B","search_c":"'10.0.8.0':78C '10.0.8.12':80C '12.1.0.0':82C '12.1.1.2':84C 'access':92C 'allow':86C 'api':76C 'argument':104C 'attack':90C 'authent':89C 'connect':77C 'could':85C 'data':98C 'delimit':105C 'due':99C 'ibm':75C 'improp':101C 'modifi':94C 'neutral':102C 'portal':97C 'remot':88C 'tenant':96C","first_public_at":"2026-11-07T05:18:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17410","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17410","severity":null,"published_at":"2026-11-07T05:18:58+00:00","modified_at":"2026-11-07T05:18:58+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","fetched_at":"2026-11-07T05:46:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17410:1956","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T05:48:53+00:00","modified_at":"2026-11-07T05:48:53+00:00","first_seen_at":"2026-11-07T05:48:53+00:00","fetched_at":"2026-11-07T05:48:53+00:00","note":"Read both IBM bulletins (-39 for 12.x, -41 for 10.0.8.x). CWE-88, CVSS 9.9. Fixed in 12.1.1.3 and 10.0.8.13; IBM lists no workarounds. Bulletin -41 metadata mentions 10.0.8.13 in range but table says up to 10.0.8.12. Tenant-sharing condition is my inference from the description, not an IBM setting.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}