CVE-2026-17339

Summary

A path traversal vulnerability in IBM API Connect allows an authenticated low-privilege attacker to access or delete resources belonging to other tenants by manipulating URL paths.

Exploitability

Requires valid authentication and low privileges; no user interaction needed, and exploitation is straightforward over the network.

Blast radius

Compromises tenant isolation, enabling unauthorized data access or deletion across tenants, potentially affecting confidentiality, integrity, and availability of multi-tenant services.

Detection

Defenders should monitor for HTTP requests containing encoded or unencoded sequences like '..%2f', '%2e%2e/', or similar path traversal patterns in API endpoints handling tenant-specific resources; anomalous access to resources outside the authenticated tenant’s scope in access logs may also indicate exploitation.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which contains the vendor-provided fix for this path traversal issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.