CVE-2026-17405

Summary

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a broken object-level authorization flaw (CWE-639) where authenticated users can access keystore objects without verifying their permission to read them, leading to unauthorized exposure of sensitive cryptographic material.

Exploitability

Exploitation requires valid authentication and low privilege, with no user interaction or complex conditions needed beyond knowing or guessing the keystore object identifiers.

Blast radius

Successful exploitation could expose keystore contents—including private keys, certificates, or secrets—enabling attackers to impersonate services, decrypt intercepted traffic, or compromise downstream systems relying on those credentials.

Detection

No reliable host or network indicator is derivable from the published description; detection would rely on reviewing access logs for authenticated users querying keystore endpoints outside expected patterns, but no specific log fields or artifacts are defined in the CVE description.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or 12.1.1.3 or later, where the broken object-level authorization check for keystore objects has been corrected.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.