CVE-2026-18689 · Infrastructure
NO FIX YET · SEE WHAT TO DO
IBM API Connect accepts a token issued for a limited purpose where it should refuse it, so an authenticated user can learn the names of other organizations on the platform. The exposure is limited to organization names, not the contents of their APIs.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running a multi-organization IBM API Connect deployment where users from one organization can log in. Single-organization or non-affected version installs are less exposed. The sources do not name a fixed version or a specific configuration check.
Not affected if single-organization, unaffected-version
Who cares api-gateway, ibm-api-connect, self-hosted
10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are the affected ranges10.0.8.12 for the 10.0.8 line is not fixed; a fixed version is not stated in the sourcesIBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.