{"id":"CVE-2026-17411","kind":"vulnerability","aliases":["CVE-2026-17411"],"related":[],"title":"IBM API Connect: SQL injection lets authenticated users alter back-end database","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not neutralize input used in database queries, so SQL injection is possible. An authenticated attacker can view, add, modify, or delete data in the back-end database.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"api-connect-v12-onprem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-connect","auth-required","ibm","self-hosted","vendor"],"not_affected_if":["auth-required","outside-affected-versions","unaffected-version"],"how_to_check":"Check your API Connect version. Affected per IBM: API Connect 10.0.8.0 - 10.0.8.12 and API Connect V12 OnPrem v12.1.0.0 - v12.1.1.2. Fixed: 10.0.8.13 and v12.1.1.3. No special setting is needed beyond a valid account.","fix":"Upgrade to 10.0.8.13 (10.0.8.x) or v12.1.1.3 (API Connect V12 OnPrem 12.1.x) via IBM Fix Central. IBM lists no workarounds or mitigations.","status":"open","published_at":"2026-11-07T05:18:58+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","triaged_at":"2026-11-07T05:52:01+00:00","updated_at":"2026-11-07T06:03:39+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:52:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: SQL injection lets authenticated users alter back-end database","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not neutralize input used in database queries, so SQL injection is possible. An authenticated attacker can view, add, modify, or delete data in the back-end database.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm","api-connect","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads, changes or deletes back-end database records","analyst_note":"Find IBM's security bulletin for CVE-2026-17411 to confirm the fixed version and any workaround; the NVD entry gives only the affected ranges.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- Confirm whether the account used to reach the management interface is shared or has broad access","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","outside-affected-versions"],"who_is_affected":"Organisations running IBM API Connect in the affected version ranges. The attacker must hold a valid account on the product, so exposure depends on who can log in and how widely accounts are granted. Installations outside the listed ranges are not affected according to the source.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4248,"output_tokens":570,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17411 to confirm the fixed version and any workaround; the NVD entry gives only the affected ranges.","search":"'-17411':16A,19A '-2026':15A,18A '10.0.8.0':43B,82C '10.0.8.12':45B,84C '12.1.0.0':47B,86C '12.1.1.2':49B,88C 'add':68B,96C 'allow':90C 'alter':9A 'api':2A,21A,24A,29B,40B,80C 'api-connect':20A,28B 'api-connect-v12-onprem':23A 'attack':65B,93C 'auth':32B 'auth-requir':31B 'authent':7A,64B,92C 'back':11A,76B,104C 'back-end':10A,75B,103C 'connect':3A,22A,25A,30B,41B,81C 'could':89C 'cve':14A,17A 'data':72B 'databas':13A,56B,78B,106C,121C 'delet':71B,99C 'due':107C 'end':12A,77B,105C 'host':37B 'ibm':1A,34B,39B,79C 'inform':100C 'inject':5A,60B,110C 'input':53B,111C 'let':6A 'modifi':69B,97C 'neutral':52B,115C 'onprem':27A 'possibl':62B 'proper':114C 'queri':57B,122C 'requir':33B 'self':36B 'self-host':35B 'sql':4A,59B,109C 'use':54B,119C 'user':8A 'v12':26A 'vendor':38B 'version':42B 'view':67B,95C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0 to 10.0.8.12 or V12 OnPrem 12.1.0.0 to 12.1.1.2. Any authenticated user can send input that is not neutralized before database queries (SQL injection, CWE-89), so they can view, add, modify or delete back-end database data (CVSS 7.6). Exposure depends on who can hold an account; teams on 10.0.8.13 or 12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:03:39Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2003},"products":{"at":"2026-11-07T06:03:39Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2003},"workarounds":{"at":"2026-11-07T06:03:39Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2003},"how_to_check":{"at":"2026-11-07T06:03:39Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2003},"who_affected":{"at":"2026-11-07T06:03:39Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2003}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apiconnect","authrequired","high","ibm","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17411':16A,19A '-2026':15A,18A 'alter':9A 'api':2A,21A,24A 'api-connect':20A 'api-connect-v12-onprem':23A 'authent':7A 'back':11A 'back-end':10A 'connect':3A,22A,25A 'cve':14A,17A 'databas':13A 'end':12A 'ibm':1A 'inject':5A 'let':6A 'onprem':27A 'sql':4A 'user':8A 'v12':26A","search_b":"'10.0.8.0':43B '10.0.8.12':45B '12.1.0.0':47B '12.1.1.2':49B 'add':68B 'api':29B,40B 'api-connect':28B 'attack':65B 'auth':32B 'auth-requir':31B 'authent':64B 'back':76B 'back-end':75B 'connect':30B,41B 'data':72B 'databas':56B,78B 'delet':71B 'end':77B 'host':37B 'ibm':34B,39B 'inject':60B 'input':53B 'modifi':69B 'neutral':52B 'possibl':62B 'queri':57B 'requir':33B 'self':36B 'self-host':35B 'sql':59B 'use':54B 'vendor':38B 'version':42B 'view':67B","search_c":"'10.0.8.0':82C '10.0.8.12':84C '12.1.0.0':86C '12.1.1.2':88C 'add':96C 'allow':90C 'api':80C 'attack':93C 'authent':92C 'back':104C 'back-end':103C 'connect':81C 'could':89C 'databas':106C,121C 'delet':99C 'due':107C 'end':105C 'ibm':79C 'inform':100C 'inject':110C 'input':111C 'modifi':97C 'neutral':115C 'proper':114C 'queri':122C 'sql':109C 'use':119C 'view':95C","first_public_at":"2026-11-07T05:18:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17411","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17411","severity":null,"published_at":"2026-11-07T05:18:58+00:00","modified_at":"2026-11-07T05:18:58+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","fetched_at":"2026-11-07T05:46:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17411:2003","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:03:39+00:00","modified_at":"2026-11-07T06:03:39+00:00","first_seen_at":"2026-11-07T06:03:39+00:00","fetched_at":"2026-11-07T06:03:39+00:00","note":"Read IBM bulletins -41 (10.0.8.x, fix 10.0.8.13) and -39 (V12 OnPrem, fix v12.1.1.3); both list CVE-2026-17411, workarounds None. No exploitation/PoC evidence checked; no social search.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}