CVE-2026-17334

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization flaw (CWE-639) where an authenticated attacker can bypass intended access controls using user-controlled keys, leading to unauthorized access to sensitive information.

Exploitability

Exploitation requires valid authentication and knowledge of how to manipulate user-controlled keys in API requests; no public exploit is available, but the low attack complexity suggests feasible execution by skilled attackers.

Blast radius

Successful exploitation could expose sensitive backend data or configurations accessible through the API gateway, potentially affecting multiple tenants or internal services depending on deployment scope.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which contains the fix for CVE-2026-17334.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.