Threats affecting pkg:maven/com.ibm/api-connect

CVE-2026-17399 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves insufficient validation of uploaded file content, allowing a remote authenticated attacker to execute arbitrary code on the server. The flaw arises from unrestricted upload of files with dangerous types that are not properly checked before processing.

CVE-2026-17383 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls using a user-controlled key, potentially exposing sensitive information from other tenants. The flaw is due to broken authorization mechanisms at the object level.

CVE-2026-17367 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials. The vulnerability has a medium severity with a CVSS score of 5.4.