Threat database

CVE-2026-17320 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves an authorization bypass due to an insecure direct object reference, allowing a remote authenticated attacker to access sensitive information without proper authorization.

CVE-2026-17319 is a vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2 where improper authorization allows a remote authenticated attacker to modify tool configuration. The flaw arises because the system relies on client-supplied information to determine user permissions, enabling unauthorized changes that can disrupt service and cause denial of service.

CVE-2026-17318 is an authorization bypass vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. A remote authenticated attacker could exploit this flaw to obtain sensitive information due to improper authorization controls.

CVE-2026-17317 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access internal resources and cause a denial of service. The vulnerability has a medium severity rating with a CVSS score of 6.4.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability due to improper validation of user-supplied input. This flaw could allow a remote attacker to induce the server to make unintended requests. The vulnerability has a high severity rating with a CVSS score of 7.2.

CVE-2026-17315 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw allows a remote attacker to obtain sensitive information by exploiting improper validation of user-supplied URLs.

CVE-2026-17314 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unintended requests, potentially leading to the exposure of sensitive information. The vulnerability has a medium severity with a CVSS score of 5. No public exploits or active exploitation in the wild have been reported. IBM has not provided specific patch information in the available data.

CVE-2026-17313 is a critical authentication bypass vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote attacker to bypass authentication via an alternate path, potentially obtaining sensitive information and gaining control over gateway configuration.

CVE-2026-17312 is a cross-site request forgery (CSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote attacker to trick a user into authenticating to an attacker-controlled account because the sign-in process does not properly verify that the login response matches the user's original request. This could cause the victim's session to be linked to the attacker's account.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization bypass vulnerability (CWE-639) that allows a remote authenticated attacker to modify application API subscriptions. This occurs due to broken object-level authorization, potentially enabling unauthorized changes to API subscriptions.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability due to the use of a hard-coded cryptographic key. This flaw could allow a remote attacker to obtain sensitive information. The vulnerability is identified as CWE-321 and has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

CVE-2026-17309 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves improper certificate validation that could allow a remote attacker to obtain sensitive information and tamper with configuration settings.

CVE-2026-17308 is a vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2 involving improper certificate validation. This flaw could allow a remote attacker to obtain sensitive credentials and manipulate tool responses. The vulnerability has a CVSS score of 6.8, indicating a medium severity level.

CVE-2026-17307 is a medium severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls and obtain sensitive information. The flaw is due to broken authorization checks related to user-controlled keys. No public exploits or patches are currently documented.

CVE-2026-17306 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw could allow a remote attacker to cause the server to make unauthorized requests to internal network resources, potentially exposing sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.8.

CVE-2026-17305 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests, potentially leading to the exposure of sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5.

CVE-2026-17304 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to retrieve unauthorized content due to insufficient validation of locations supplied during service definition imports.

CVE-2026-17303 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make requests to internal network resources by supplying a crafted URL that is not properly validated. This improper validation can lead to unauthorized access to internal systems.

CVE-2026-17302 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to send crafted requests that could probe internal network services due to improper validation of user-supplied URLs. The vulnerability has a medium severity with a CVSS score of 5. No public exploits or known active exploitation have been reported. No patch information is provided in the available data.

CVE-2026-17301 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper verification of a cryptographic signature, which could allow an unauthenticated attacker to bypass authentication controls.