{"id":"CVE-2026-17150","published":"2026-11-07T05:18:28.230","lastModified":"2026-11-10T16:50:38.630","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-184"],"vendors":["ibm"],"products":["api connect"],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["Vendor Advisory"]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect contains an insufficient input validation vulnerability (CWE-184) that allows authenticated attackers to upload malicious custom module content, leading to arbitrary code execution and cross-tenant data access due to lack of proper sandboxing during processing.","exploitability":"Requires low-privilege authenticated access; no user interaction or complex conditions needed.","blast_radius":"Successful exploitation enables full tenant isolation bypass, allowing attackers to compromise other tenants' systems and exfiltrate sensitive cross-tenant data.","remediation":"Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3 (or later), which contains the vendor-provided fix for this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","tenant-isolation-bypass","input-validation","authenticated"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:45:06.440Z"}}