IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to bypass authentication via an alternate path. This flaw enables the attacker to obtain sensitive information and potentially take control of the gateway configuration. The vulnerability is identified as CVE-2026-17313 and has a critical severity rating with a CVSS score of 9.8.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows unauthenticated attackers to bypass authentication due to improper verification of a cryptographic signature. This flaw could lead to full compromise of confidentiality, integrity, and availability of the affected system.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform arbitrary file reads and server-side request forgery. This is due to insufficient restrictions on externally referenced content in submitted definitions, which can be exploited to retrieve content and return it to the attacker.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to take over ownership of organizations they do not control. This is due to incomplete access checks on organization objects, resulting in broken object-level authorization.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. This vulnerability is identified as CVE-2026-17296 and has a critical severity with a CVSS score of 9.6. The flaw impacts confidentiality and integrity but does not affect availability. No information about patches or fixes is provided.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an open redirect vulnerability that could allow a remote attacker to perform an account takeover. The vulnerability arises because the redirect address used during sign-in is not sufficiently validated, enabling authentication results to be sent to an attacker-controlled location. This flaw has a critical severity with a CVSS score of 9.6.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote authenticated attacker to execute arbitrary code. This vulnerability has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows remote attackers to gain unauthorized access to sensitive API catalog and runtime configuration data. This occurs due to improper authentication where client-supplied information is insufficiently verified, enabling an attacker to impersonate a trusted party.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants. This is due to insufficient input validation of uploaded custom module content, which can be processed with privileges beyond the attacker's own tenant.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to gain elevated privileges due to improper authentication. This vulnerability has a critical severity with a CVSS score of 9.9.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability that allows a remote authenticated attacker to execute arbitrary SQL commands. This vulnerability can lead to full compromise of confidentiality, integrity, and availability of the affected system.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability that allows a remote authenticated attacker to access sensitive information and modify or delete data belonging to other tenants. This flaw arises from missing authorization checks, enabling cross-tenant data compromise.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary JavaScript and access sensitive information due to improper input validation. This vulnerability is classified as cross-site scripting (CWE-79) and has a critical severity with a CVSS score of 9.9.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote attacker to bypass restrictions on outbound requests. This could enable the attacker to make the server contact unintended destinations and obtain sensitive information from the responses.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions. This vulnerability is critical with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This is due to improper control over modification of object attributes, enabling a user to set fields that should be system-controlled, potentially leading to code execution.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary SQL commands. This is due to improper neutralization of special elements in SQL commands, leading to SQL injection. The vulnerability has a critical severity with a CVSS score of 9.9.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to an XML External Entity (XXE) injection that could allow a remote attacker to obtain sensitive information. This vulnerability has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy flaw. This vulnerability has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a critical vulnerability that allows remote attackers to obtain valid access tokens for other users. This occurs because authentication against a connected directory service is not sufficiently enforced, enabling attackers to assume another user's identity.