CVE-2026-17380

Summary

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a path traversal vulnerability (CWE-22) where an authenticated attacker can bypass tenant isolation by manipulating a path parameter to access data belonging to other tenants. This occurs due to insufficient validation of the path value in requests.

Exploitability

Exploitation requires valid authentication and knowledge of the vulnerable endpoint, but is otherwise straightforward due to low attack complexity and no user interaction needed.

Blast radius

Successful exploitation could lead to cross-tenant data exposure, compromising confidentiality for other tenants and potentially enabling further lateral movement within the platform.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3, which contain the fix for CVE-2026-17380.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.