high · CVSS v3 8.5

CVE-2026-17388

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 have a flaw that allows a remote authenticated attacker to bypass object‑l

Overview

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 have a flaw that allows a remote authenticated attacker to bypass object‑level authorization and retrieve sensitive data. This vulnerability can expose confidential API metadata and user information. It is critical for organizations using these IBM API Connect releases to address promptly.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

Impact

Confidentiality: unauthorized disclosure of API definitions, user credentials, and internal data. Integrity: potential manipulation of API configurations. Availability: not directly impacted. Defenders: IBM API Connect administrators and security teams must ensure proper role‑based access controls and monitor for anomalous access patterns.

Remediation

Apply the latest IBM API Connect patch that fixes the broken object‑level authorization. If patching is not immediately possible, enforce strict role‑based access controls, remove unnecessary privileged accounts, and monitor API usage logs for suspicious activity. Consider disabling or restricting the affected API endpoints until a patch is applied.

Risk context

Severity high with CVSS 8.5 indicates significant risk. No EPSS data available. Defenders should treat this as a high‑priority issue and apply mitigations promptly.

Affected products

  • IBM API Connect 10.0.8
  • IBM API Connect 12.1.0

Scores

Severity
high
CVSS v2
7.5
CVSS v3
8.5
CVSS v4
—
EPSS
—

IBM API Connect authorization confidentiality high severity remote authenticated object-level

← All CVEs

Related CVEs

high

CVE-2026-16715

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 have a broken object-level authorization flaw that lets a remote authenticated user read data belonging to other tenants. This can expose sensitive tenant data and compromise isolation boundaries. The vulnerability is rated high with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16717

IBM API Connect versions 12.1.0.0 to 12.1.1.2 have a flaw that allows authenticated attackers to bypass object-level authorization and access sensitive data. The vulnerability can lead to data exposure and compromise of confidential information. It is rated high severity with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16718

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑12.1.1.2 are vulnerable to a remote authenticated information disclosure due to improper file path validation. An attacker with valid credentials can read sensitive files on the host. This can expose configuration, credentials, or other confidential data.

View analysis

high

CVE-2026-16854

IBM API Connect 12.1.0.0 through 12.1.1.2 is vulnerable to a remote authenticated injection that can expose data from other tenants. The flaw allows attackers to craft queries that return unauthorized sensitive information. This impacts multi-tenant deployments where tenant isolation is critical.

View analysis