CVE-2026-17190

Summary

IBM API Connect contains a stored cross-site scripting (XSS) vulnerability where unsanitized HTML content provided by an authenticated provider is rendered in the web interface, allowing execution of arbitrary JavaScript in victims' browsers. This enables session hijacking, credential theft, or malicious actions performed on behalf of the user.

Exploitability

Exploitation requires a low-privilege authenticated attacker (PR:L) to supply malicious HTML/JS via provider-controlled content and trick a victim user into viewing it (UI:R), making it moderately difficult due to the need for social engineering and valid credentials.

Blast radius

If exploited, an attacker could steal session tokens, impersonate users, modify UI to deceive users, or redirect to malicious sites, potentially compromising administrative functions if high-privilege users are targeted.

Detection

Defenders should monitor web application logs for requests containing unsanitized HTML/JS payloads (e.g., <script>, onerror=, javascript:) in provider-submitted fields such as description, name, or metadata fields; anomalies in user-agent behavior or unexpected outbound requests from the browser context may also indicate successful exploitation.

Prioritized remediation

Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3, which contain the vendor-provided fix for this XSS vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.