CVE-2026-17388

Summary

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a broken object-level authorization vulnerability (CWE-639), allowing an authenticated attacker to access sensitive data belonging to other users or tenants by bypassing intended access controls. This is a classic horizontal or vertical privilege escalation via IDOR.

Exploitability

Exploitation requires valid authentication and low skill, as it typically involves manipulating resource identifiers (e.g., IDs in URLs or API requests) without needing complex payloads or conditions.

Blast radius

Successful exploitation could expose sensitive tenant or user data, compromise confidentiality of multi-tenant configurations, and undermine trust in the API gateway’s isolation guarantees.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or 12.1.1.3 (or later), as these versions include fixes for CVE-2026-17388.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.