Act nowDisclosed

Advisory · CVE-2026-17313

IBM API Connect alternate-path authentication bypass hands attackers gateway control

IBM API Connect 12.1.0.0 through 12.1.1.2 lets a remote attacker obtain sensitive information and take control of gateway configuration through an authentication bypass via an alternate path, rated critical at CVSS 9.8.

Advisory published November 7, 2026Independent summary
Vendor
IBM
Product
API Connect
Identifier / CWE
CVE-2026-17313
CWE-288
Action timing
Immediate
ELI5

Explain it like I’m five

The front door of API Connect is locked, but there is a side corridor that nobody guarded. An attacker can walk in through the side corridor and reach the controls for the whole gateway.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Alternate path found

    A remote attacker sends a request to API Connect 12.1.0.0 through 12.1.1.2 through an alternate path that skips the authentication check.

  2. 02Authentication bypassed

    The request reaches protected functions without any credentials.

  3. 03Gateway configuration reached

    The attacker obtains sensitive information and takes control of gateway configuration.

  4. 04No login required

    No authentication is needed, so any network attacker can attempt it.

What happened

IBM disclosed CVE-2026-17313 as part of a multi-vulnerability API Connect bulletin: API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and take control of gateway configuration due to authentication bypass via an alternate path. The record rates it critical at CVSS 9.8 under version 3.1, with network attack vector, low complexity, and no privileges required.

This is one of about 98 CVEs in the same IBM API Connect bulletin; this advisory covers only this CVE. The bulletin text read for this run does not state a fixed release version, so none is claimed here. Gateway configuration control means the attacker can reshape how APIs are exposed and who can reach them.

What to do

  1. Inventory IBM API Connect deployments and record each version, including management, gateway, and analytics components.
  2. Apply the fix from IBM’s security bulletin for the affected release lines.
  3. Until patched, restrict network access to the API Connect management and gateway interfaces and treat them as untrusted-input surfaces.
  4. Review access and audit logs for token use by unexpected users, unexpected administrative operations, and requests to internal or metadata addresses.
  5. Rotate API keys, tokens, and credentials if misuse or unauthorized access cannot be excluded.
  6. Verify the deployed version after updating.

Management note

An alternate path around authentication is a back door by another name, and this one leads to gateway configuration. Patch, then check whether the gateway configuration changed while the path was open.