Act nowDisclosed

Advisory · CVE-2026-17360

IBM API Connect hard-coded credentials give remote attackers full administrative control

IBM API Connect 12.1.0.0 through 12.1.1.2 uses hard-coded credentials that let a remote attacker gain full administrative control, rated critical at CVSS 9.8.

Advisory published November 7, 2026Independent summary
Vendor
IBM
Product
API Connect
Identifier / CWE
CVE-2026-17360
CWE-798
Action timing
Immediate
ELI5

Explain it like I’m five

API Connect ships with a master key baked into the product, the same key in every copy. Anyone who knows it can log in as an administrator on any unpatched deployment.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Hard-coded credential known

    A remote attacker learns the hard-coded credential shipped in API Connect 12.1.0.0 through 12.1.1.2.

  2. 02Credential presented

    The attacker presents the credential to the affected component over the network.

  3. 03Admin access granted

    The component accepts the built-in credential and grants administrative access.

  4. 04Full control taken

    The attacker gains full administrative control of the deployment.

What happened

IBM disclosed CVE-2026-17360 as part of a multi-vulnerability API Connect bulletin: API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials. The record rates it critical at CVSS 9.8 under version 3.1, with network attack vector, low complexity, and no privileges required.

This is one of about 98 CVEs in the same IBM API Connect bulletin; this advisory covers only this CVE. The bulletin text read for this run does not state a fixed release version, so none is claimed here. Hard-coded credentials are the same in every deployment, so the flaw is exploitable wherever the affected component is reachable, with no per-site secret to guess.

What to do

  1. Inventory IBM API Connect deployments and record each version, including management, gateway, and analytics components.
  2. Apply the fix from IBM’s security bulletin for the affected release lines.
  3. Until patched, restrict network access to the API Connect management and gateway interfaces and treat them as untrusted-input surfaces.
  4. Review access and audit logs for token use by unexpected users, unexpected administrative operations, and requests to internal or metadata addresses.
  5. Rotate API keys, tokens, and credentials if misuse or unauthorized access cannot be excluded.
  6. Verify the deployed version after updating.

Management note

A built-in credential that works everywhere is a master key for the whole install base. Patch, then rotate every credential the admin account could have touched, because the hard-coded one was never yours to control.