Act nowDisclosed

Advisory · CVE-2026-17278

IBM API Connect authentication flaw exposes API catalog and runtime configuration

IBM API Connect 12.1.0.0 through 12.1.1.2 lets a remote attacker gain unauthorized access to sensitive API catalog and runtime configuration data because client-supplied information is not sufficiently verified, rated critical at CVSS 9.8.

Advisory published November 7, 2026Independent summary
Vendor
IBM
Product
API Connect
Identifier / CWE
CVE-2026-17278
CWE-290
Action timing
Immediate
ELI5

Explain it like I’m five

API Connect checks whether a caller looks like a trusted party, but it trusts what the caller says about itself. An attacker can dress up as a trusted caller and be handed the catalog and the runtime configuration.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Spoofed request sent

    A remote attacker sends a request to API Connect 12.1.0.0 through 12.1.1.2 carrying client-supplied information that claims trusted status.

  2. 02Verification insufficient

    The information supplied by the client is not sufficiently verified, so the caller appears as a trusted party.

  3. 03Catalog and config exposed

    The attacker gains unauthorized access to sensitive API catalog and runtime configuration data.

  4. 04No login required

    No authentication is needed, so any network attacker can attempt it.

What happened

IBM disclosed CVE-2026-17278 as part of a multi-vulnerability API Connect bulletin: API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to appear as a trusted party. The record rates it critical at CVSS 9.8 under version 3.1, with network attack vector, low complexity, and no privileges required.

This is one of about 98 CVEs in the same IBM API Connect bulletin; this advisory covers only this CVE. The bulletin text read for this run does not state a fixed release version, so none is claimed here. Catalog and runtime configuration data includes the keys and endpoints an attacker needs to move deeper, so treat any exposure as a credential event.

What to do

  1. Inventory IBM API Connect deployments and record each version, including management, gateway, and analytics components.
  2. Apply the fix from IBM’s security bulletin for the affected release lines.
  3. Until patched, restrict network access to the API Connect management and gateway interfaces and treat them as untrusted-input surfaces.
  4. Review access and audit logs for token use by unexpected users, unexpected administrative operations, and requests to internal or metadata addresses.
  5. Rotate API keys, tokens, and credentials if misuse or unauthorized access cannot be excluded.
  6. Verify the deployed version after updating.

Management note

Unauthenticated access to the catalog and runtime configuration hands an attacker the map and the keys. Patch, then rotate anything that configuration could have exposed.