{"id":"CVE-2026-17278","published":"2026-11-07T05:18:33.440","lastModified":"2026-11-10T16:53:33.833","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to appear as a trusted party.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-290"],"vendors":["ibm"],"products":["api connect"],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 suffer from improper authentication (CWE-290), allowing unauthenticated attackers to gain unauthorized access to sensitive API catalog and runtime configuration data by impersonating a trusted party due to insufficient client-side input validation.","exploitability":"Exploitation is highly accessible as it requires only network-level access with no authentication, privileges, or user interaction.","blast_radius":"Successful exploitation could lead to full compromise of confidentiality, integrity, and availability of the API management platform, potentially exposing all APIs, their configurations, and enabling further lateral movement within the infrastructure.","remediation":"Upgrade to IBM API Connect 12.1.1.3 or later, which contains the vendor-provided fix for this authentication bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","api-management","cwe-290","critical","ibm"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:56:22.691Z"}}