CVE-2026-17328

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an incomplete input validation flaw (CWE-918) that allows an authenticated attacker to bypass security checks and access sensitive information remotely. This is a server-side request forgery (SSRF)-like vulnerability where improper sanitization enables data leakage.

Exploitability

Exploitation requires valid authentication credentials and knowledge of vulnerable endpoints, with moderate difficulty due to incomplete input validation that may be bypassed via obfuscation or edge cases.

Blast radius

Successful exploitation could expose internal system details, configuration data, or backend service responses, potentially enabling further compromise of the API gateway or connected services.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which contains fixes for this input validation issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.