---
id: "CVE-2026-17411"
page: "https://infrastack.ai/live/CVE-2026-17411"
kind: "vulnerability"
aliases: ["CVE-2026-17411"]
title: "IBM API Connect: SQL injection lets authenticated users alter back-end database"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "api-connect", "fixed": ["10.0.8.13"], "affected": ">= 10.0.8.0, <= 10.0.8.12", "ecosystem": "vendor"}, {"name": "api-connect-v12-onprem", "fixed": ["12.1.1.3"], "affected": ">= 12.1.0.0, <= 12.1.1.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["api-connect", "auth-required", "ibm", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "outside-affected-versions", "unaffected-version"]
published_at: "2026-11-07T05:18:58+00:00"
first_seen_at: "2026-11-07T05:46:08+00:00"
updated_at: "2026-11-07T06:03:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17411", "first_seen_at": "2026-11-07T05:46:08+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41", "first_seen_at": "2026-11-07T06:03:39+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41", "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}]
exploit_sources: []
---

# IBM API Connect: SQL injection lets authenticated users alter back-end database

Link for people: https://infrastack.ai/live/CVE-2026-17411 (this .md is for agents)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not neutralize input used in database queries, so SQL injection is possible. An authenticated attacker can view, add, modify, or delete data in the back-end database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:api-connect affected >= 10.0.8.0, <= 10.0.8.12 fixed 10.0.8.13
- vendor:api-connect-v12-onprem affected >= 12.1.0.0, <= 12.1.1.2 fixed 12.1.1.3

## How to check

Check your API Connect version. Affected per IBM: API Connect 10.0.8.0 - 10.0.8.12 and API Connect V12 OnPrem v12.1.0.0 - v12.1.1.2. Fixed: 10.0.8.13 and v12.1.1.3. No special setting is needed beyond a valid account.

## Fix

Upgrade to 10.0.8.13 (10.0.8.x) or v12.1.1.3 (API Connect V12 OnPrem 12.1.x) via IBM Fix Central. IBM lists no workarounds or mitigations.

## Timeline

- 2026-11-07T05:46:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17411
- 2026-11-07T06:03:39+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41 — Read IBM bulletins -41 (10.0.8.x, fix 10.0.8.13) and -39 (V12 OnPrem, fix v12.1.1.3); both list CVE-2026-17411, workarounds None. No exploitation/PoC evidence checked; no social search.

## Documents

- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41
- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39

## From the sources

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_