CVE-2026-17066

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 lack proper authorization checks, allowing authenticated attackers to access and modify or delete data belonging to other tenants, leading to confidentiality, integrity, and availability breaches.

Exploitability

Exploitation requires a valid authenticated account with high privileges (PR:H), but no user interaction is needed and the attack can be launched remotely over the network.

Blast radius

A successful exploit could enable one tenant's compromised account to read, modify, or delete another tenant's data across the platform, potentially affecting all tenants sharing the infrastructure.

Detection

Defenders should monitor for anomalous cross-tenant API access patterns in IBM API Connect audit logs—specifically, requests from a tenant's authenticated session targeting resources (e.g., APIs, organizations, catalogs) belonging to a different tenant—and correlate with user activity logs to identify privilege escalation or lateral movement attempts.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which includes fixes for this authorization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.