Advisory · CVE-2026-17301
IBM API Connect signature verification flaw lets unauthenticated attackers bypass authentication
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 lets an unauthenticated attacker bypass authentication because a cryptographic signature is not properly verified, rated critical at CVSS 9.8.
- Vendor
- IBM
- Product
- API Connect
- Identifier / CWE
- CVE-2026-17301
CWE-347 - Action timing
- Immediate
Explain it like I’m five
API Connect checks a signed note to decide whether you are allowed in, but it does not check the signature properly. An attacker can hand over a forged note and be waved through the gate.
- 01Forged signed request
An unauthenticated attacker sends a request carrying a cryptographic signature that should not validate.
- 02Signature check fails open
API Connect does not properly verify the cryptographic signature, so the invalid signature is accepted.
- 03Authentication bypassed
The attacker is treated as authenticated without ever proving who they are.
- 04Protected functions reached
The attacker reaches functions and data reserved for authenticated users.
What happened
IBM disclosed CVE-2026-17301 as part of a multi-vulnerability API Connect bulletin: API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature. The record rates it critical at CVSS 9.8 under version 3.1, with network attack vector, low complexity, and no privileges required.
This is one of about 98 CVEs in the same IBM API Connect bulletin; this advisory covers only this CVE. The bulletin text read for this run does not state a fixed release version, so none is claimed here. A signature check that fails open removes the only gate between the network and authenticated functions.
What to do
- Inventory IBM API Connect deployments and record each version, including management, gateway, and analytics components.
- Apply the fix from IBM’s security bulletin for the affected release lines.
- Until patched, restrict network access to the API Connect management and gateway interfaces and treat them as untrusted-input surfaces.
- Review access and audit logs for token use by unexpected users, unexpected administrative operations, and requests to internal or metadata addresses.
- Rotate API keys, tokens, and credentials if misuse or unauthorized access cannot be excluded.
- Verify the deployed version after updating.
Management note
When the signature check is the gate and the gate is open, every authenticated function is public. Patch, then audit who used authenticated functions without a valid signature.