Threat database

CVE-2026-17279 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause a denial of service by triggering uncontrolled resource consumption. Certain crafted requests can cause internal processing to stall, making the service unavailable.

CVE-2026-17278 is a critical authentication bypass vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw allows a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data by exploiting insufficient verification of client-supplied information. This enables the attacker to impersonate a trusted party without proper authentication.

CVE-2026-17244 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves missing authorization checks that allow a remote authenticated attacker to perform unauthorized actions, including deleting other users' API keys and accessing sensitive information.

CVE-2026-17241 is a medium severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass authorization controls via a user-controlled key, potentially leading to unauthorized access to sensitive information. The vulnerability does not affect system integrity or availability but compromises confidentiality.

CVE-2026-17240 is an improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. Due to inconsistent application of authentication checks, a remote attacker could bypass security restrictions and access protected resources without valid credentials. The vulnerability has a medium severity with a CVSS score of 6.5.

A path traversal vulnerability (CWE-22) exists in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw could allow a remote authenticated attacker to execute arbitrary code on the affected system. The vulnerability has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-17238 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw arises from insufficient validation of values in the request path, which can allow a remote authenticated attacker to access sensitive information belonging to other tenants.

CVE-2026-17237 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. A remote authenticated attacker could exploit this flaw to obtain sensitive information. The vulnerability has a medium severity with a CVSS score of 6.4.

CVE-2026-17236 is an authorization bypass vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information by exploiting improper authorization checks when resolving certain organization URLs.

CVE-2026-17233 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests to internal network services by supplying improperly validated URLs. This could lead to information disclosure about internal systems.

CVE-2026-17232 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It arises from improper neutralization of special elements in request parameters, allowing a remote attacker to bypass security restrictions by crafting specially formed requests. The vulnerability has a medium severity with a CVSS score of 6.1.

CVE-2026-17231 is a medium severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote attacker to obtain sensitive information due to observable differences in responses. The vulnerability does not affect integrity or availability but impacts confidentiality.

CVE-2026-17230 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information by exploiting improper validation of file paths. The vulnerability has a medium severity with a CVSS score of 5.4.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows a remote authenticated attacker to bypass destination restrictions on outbound requests, potentially enabling the server to access unintended resources and obtain sensitive information.

CVE-2026-17225 affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerability arises from improper input validation of request parameters, allowing a remote authenticated attacker to bypass security restrictions and access unauthorized analytics queries. This flaw could lead to unauthorized access to analytics data.

CVE-2026-17215 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information due to verbose error messages that reveal more system details than necessary. This information disclosure could aid an attacker in understanding the environment.

CVE-2026-17214 is an LDAP injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw could allow a remote attacker to bypass security restrictions by injecting malicious LDAP statements. The vulnerability has a medium severity rating with a CVSS score of 4.8.

CVE-2026-17211 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves incorrect type conversion or casting that can be triggered by a remote authenticated attacker to cause a denial of service. This flaw may lead the service to return invalid responses or become unavailable.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows remote attackers to enumerate usernames by observing differences in response behavior. This issue is classified as CWE-204, Observable Response Discrepancy. The vulnerability has a medium severity with a CVSS score of 5.3.

CVE-2026-17190 is a high-severity cross-site scripting (XSS) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary JavaScript in the context of the user's browser because HTML content provided by a provider is not properly sanitized before display.