CVE-2026-17392

Summary

IBM API Connect contains an LDAP injection vulnerability in directory queries that allows an authenticated attacker to manipulate LDAP filters using unsanitized user input, thereby gaining unauthorized administrative access to other tenants' data and resources.

Exploitability

Exploitation requires valid low-privilege authentication and knowledge of how to craft malicious LDAP filter inputs; no public exploit exists, but the attack is straightforward for an attacker with basic LDAP injection experience.

Blast radius

A successful exploit enables tenant isolation bypass, allowing a compromised low-privilege user to read, modify, or delete data belonging to other tenants—including administrative functions—potentially affecting all tenants sharing the same API Connect instance.

Detection

Defenders should monitor LDAP query logs for unexpected special characters (e.g., parentheses, ampersands, or pipe symbols) in user-supplied filter components, especially when such queries originate from authenticated but non-administrative API Connect users; anomalous increases in directory query complexity or scope may also indicate exploitation attempts.

Prioritized remediation

Upgrade IBM API Connect to version 10.0.8.13 or later for the 10.0.x branch, or to version 12.1.1.3 or later for the 12.1.x branch, as these versions contain the vendor-provided fix for the LDAP injection flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.