CVE-2026-17278

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 suffer from improper authentication (CWE-290), allowing unauthenticated attackers to gain unauthorized access to sensitive API catalog and runtime configuration data by impersonating a trusted party due to insufficient client-side input validation.

Exploitability

Exploitation is highly accessible as it requires only network-level access with no authentication, privileges, or user interaction.

Blast radius

Successful exploitation could lead to full compromise of confidentiality, integrity, and availability of the API management platform, potentially exposing all APIs, their configurations, and enabling further lateral movement within the infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which contains the vendor-provided fix for this authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.