---
id: "CVE-2026-19121"
page: "https://infrastack.ai/live/CVE-2026-19121"
kind: "vulnerability"
aliases: ["CVE-2026-19121"]
title: "IBM API Connect: authenticated users can reach other tenants' resources"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "API Connect V12 OnPrem", "fixed": ["12.1.1.3"], "affected": ">= 12.1.0.0, <= 12.1.1.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["api-gateway", "ibm-api-connect", "multi-tenant", "self-hosted", "vendor"]
not_affected_if: ["outside-affected-range", "single-tenant"]
published_at: "2026-11-07T05:18:59+00:00"
first_seen_at: "2026-11-07T05:46:08+00:00"
updated_at: "2026-11-07T06:03:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19121", "first_seen_at": "2026-11-07T05:46:08+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/node/7295635", "first_seen_at": "2026-11-07T06:03:31+00:00", "cites": ["https://www.ibm.com/support/pages/node/7295635"]}]
exploit_sources: []
---

# IBM API Connect: authenticated users can reach other tenants' resources

Link for people: https://infrastack.ai/live/CVE-2026-19121 (this .md is for agents)

IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not check that a signed-in user belongs to the tenant they are acting in. A logged-in attacker can gain unauthorized access to another tenant's resources.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:API Connect V12 OnPrem affected >= 12.1.0.0, <= 12.1.1.2 fixed 12.1.1.3

## How to check

Check your IBM API Connect V12 OnPrem version: affected if v12.1.0.0 through v12.1.1.2; fixed in v12.1.1.3. IBM lists no setting that limits exposure and no workaround.

## Fix

Upgrade IBM API Connect to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)

## Timeline

- 2026-11-07T05:46:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-19121
- 2026-11-07T06:03:31+00:00 analyst https://www.ibm.com/support/pages/node/7295635 — IBM bulletin node/7295635 lists CVE-2026-19121 (CVSS 8.3): affected API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fix v12.1.1.3, workarounds None. No tenant-isolation setting mentioned. Exploitation/PoC not checked beyond NVD/KEV absence.

## Documents

- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3) https://www.ibm.com/support/pages/node/7295635

## From the sources

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_