Act nowDisclosed

Advisory · CVE-2026-17132

IBM API Connect SQL injection lets authenticated attackers run arbitrary SQL commands

IBM API Connect 12.1.0.0 through 12.1.1.2 lets a remote authenticated attacker execute arbitrary SQL commands because special elements in an SQL command are not properly neutralized, rated critical at CVSS 9.9.

Advisory published November 7, 2026Independent summary
Vendor
IBM
Product
API Connect
Identifier / CWE
CVE-2026-17132
CWE-89
Action timing
Immediate
ELI5

Explain it like I’m five

API Connect builds its database questions by pasting user input straight into them. An attacker can paste extra database instructions and make the database run them, reading or changing whatever it holds.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated request sent

    A remote authenticated attacker sends a request with crafted input to API Connect 12.1.0.0 through 12.1.1.2.

  2. 02Input reaches the query

    Special elements in the input are not neutralized before they are used in an SQL command.

  3. 03Arbitrary SQL runs

    The database executes the attacker-supplied SQL commands.

  4. 04Data read or changed

    The attacker reads or modifies database contents, including credentials and configuration.

What happened

IBM disclosed CVE-2026-17132 as part of a multi-vulnerability API Connect bulletin: API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command. The record rates it critical at CVSS 9.9 under version 3.1, with network attack vector, low complexity, low privileges required, and changed scope.

This is one of about 98 CVEs in the same IBM API Connect bulletin; this advisory covers only this CVE. The bulletin text read for this run does not state a fixed release version, so none is claimed here. Arbitrary SQL against the platform database is a direct path to the credentials and configuration the gateway stores.

What to do

  1. Inventory IBM API Connect deployments and record each version, including management, gateway, and analytics components.
  2. Apply the fix from IBM’s security bulletin for the affected release lines.
  3. Until patched, restrict network access to the API Connect management and gateway interfaces and treat them as untrusted-input surfaces.
  4. Review access and audit logs for token use by unexpected users, unexpected administrative operations, and requests to internal or metadata addresses.
  5. Rotate API keys, tokens, and credentials if misuse or unauthorized access cannot be excluded.
  6. Verify the deployed version after updating.

Management note

SQL injection on the platform database is not a data leak, it is a credential harvest. Patch, then check the database for unexpected reads or writes while the flaw was open.