Advisory · CVE-2026-16920
IBM API Connect confused deputy flaw lets authenticated attackers bypass security restrictions
IBM API Connect 12.1.0.0 through 12.1.1.2 lets a remote authenticated attacker bypass security restrictions through a confused deputy vulnerability, rated critical at CVSS 9.9.
- Vendor
- IBM
- Product
- API Connect
- Identifier / CWE
- CVE-2026-16920
CWE-441 - Action timing
- Immediate
Explain it like I’m five
API Connect acts on behalf of whoever asks it, but it does not check whether the requester is allowed to ask for that. A low-privilege user can trick the trusted middleman into doing privileged things for them.
- 01Authenticated user logs in
A remote authenticated attacker with a low-privilege API Connect account prepares a request.
- 02Trusted service invoked
The request asks a trusted API Connect component to act, and the component does not verify the caller's authority for that action.
- 03Security restrictions bypassed
The component performs the privileged operation on the attacker's behalf.
- 04Restricted access gained
The attacker reaches functions and data beyond their own permissions.
What happened
IBM disclosed CVE-2026-16920 as part of a multi-vulnerability API Connect bulletin: API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy vulnerability. The record rates it critical at CVSS 9.9 under version 3.1, with network attack vector, low complexity, low privileges required, and changed scope.
This is one of about 98 CVEs in the same IBM API Connect bulletin; this advisory covers only this CVE. The bulletin text read for this run does not state a fixed release version, so none is claimed here. The attacker needs an account, but any authenticated user is a starting point, and the deputy pattern means the damage is bounded only by what the trusted component can do.
What to do
- Inventory IBM API Connect deployments and record each version, including management, gateway, and analytics components.
- Apply the fix from IBM’s security bulletin for the affected release lines.
- Until patched, restrict network access to the API Connect management and gateway interfaces and treat them as untrusted-input surfaces.
- Review access and audit logs for token use by unexpected users, unexpected administrative operations, and requests to internal or metadata addresses.
- Rotate API keys, tokens, and credentials if misuse or unauthorized access cannot be excluded.
- Verify the deployed version after updating.
Management note
Confused deputy flaws turn every low-privilege account into a potential admin, because the trusted component does the asking. Patch, then audit what authenticated users did while the checks were missing.