{"id":"CVE-2026-19124","kind":"vulnerability","aliases":["CVE-2026-19124"],"related":[],"title":"IBM API Connect: hard-coded key lets stored credentials be decrypted","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 could allow an attacker with access to stored data to decrypt sensitive credentials due to the use of a hard-coded cryptographic key. The key protecting stored credentials is built into the product, so credentials could be decrypted if the stored data is obtained.","summary":"IBM API Connect 10.0.8.0 through 10.0.8.12 protects stored credentials with a cryptographic key built into the product. An attacker who obtains the stored data can decrypt the credentials.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check whether the installed API Connect version is between `10.0.8.0` and `10.0.8.12`\n- Confirm whether your deployment stores credentials that this installation protects","fix":null,"status":"open","published_at":"2026-11-07T05:19:00+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","triaged_at":"2026-11-07T05:52:23+00:00","updated_at":"2026-11-07T05:52:23+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:52:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"IBM API Connect: hard-coded key lets stored credentials be decrypted","impact":"medium","summary":"IBM API Connect 10.0.8.0 through 10.0.8.12 protects stored credentials with a cryptographic key built into the product. An attacker who obtains the stored data can decrypt the credentials.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker decrypts stored credentials after obtaining the data","analyst_note":"Check the IBM security bulletin for this CVE for the fixed version and any interim mitigation; the sources give only the affected range.","how_to_check":"- Check whether the installed API Connect version is between `10.0.8.0` and `10.0.8.12`\n- Confirm whether your deployment stores credentials that this installation protects","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running IBM API Connect 10.0.8.0 through 10.0.8.12 that store credentials in the product. Exposure requires an attacker to already be able to obtain the stored data, so access controls on that data reduce risk. Installations outside that version range are not affected by this advisory.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":4242,"output_tokens":523,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-19124':15A,18A '-2026':14A,17A '10.0.8.0':33B,61C '10.0.8.12':35B,63C 'access':69C 'allow':65C 'api':2A,20B,24B,31B,59C 'api-gateway':19B 'attack':48B,67C 'built':43B,94C 'code':6A,85C 'connect':3A,25B,32B,60C 'could':64C,100C 'credenti':10A,38B,57B,76C,92C,99C 'cryptograph':41B,86C 'cve':13A,16A 'data':53B,72C,106C 'decrypt':12A,55B,74C,102C 'due':77C 'gateway':21B 'hard':5A,84C 'hard-cod':4A,83C 'host':29B 'ibm':1A,23B,30B,58C 'ibm-api-connect':22B 'infrastructur':26B 'key':7A,42B,87C,89C 'let':8A 'obtain':50B,108C 'product':46B,97C 'protect':36B,90C 'self':28B 'self-host':27B 'sensit':75C 'store':9A,37B,52B,71C,91C,105C 'use':80C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect 10.0.8.0 through 10.0.8.12 that store credentials in the product. Exposure requires an attacker to already be able to obtain the stored data, so access controls on that data reduce risk. Installations outside that version range are not affected by this advisory.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-19124':15A,18A '-2026':14A,17A 'api':2A 'code':6A 'connect':3A 'credenti':10A 'cve':13A,16A 'decrypt':12A 'hard':5A 'hard-cod':4A 'ibm':1A 'key':7A 'let':8A 'store':9A","search_b":"'10.0.8.0':33B '10.0.8.12':35B 'api':20B,24B,31B 'api-gateway':19B 'attack':48B 'built':43B 'connect':25B,32B 'credenti':38B,57B 'cryptograph':41B 'data':53B 'decrypt':55B 'gateway':21B 'host':29B 'ibm':23B,30B 'ibm-api-connect':22B 'infrastructur':26B 'key':42B 'obtain':50B 'product':46B 'protect':36B 'self':28B 'self-host':27B 'store':37B,52B","search_c":"'10.0.8.0':61C '10.0.8.12':63C 'access':69C 'allow':65C 'api':59C 'attack':67C 'built':94C 'code':85C 'connect':60C 'could':64C,100C 'credenti':76C,92C,99C 'cryptograph':86C 'data':72C,106C 'decrypt':74C,102C 'due':77C 'hard':84C 'hard-cod':83C 'ibm':58C 'key':87C,89C 'obtain':108C 'product':97C 'protect':90C 'sensit':75C 'store':71C,91C,105C 'use':80C","first_public_at":"2026-11-07T05:19:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19124","severity":null,"published_at":"2026-11-07T05:19:00+00:00","modified_at":"2026-11-07T05:19:00+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","fetched_at":"2026-11-07T05:46:08+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}