{"id":"CVE-2026-17339","published":"2026-11-07T05:18:45.287","lastModified":"2026-11-10T20:19:10.983","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access or delete resources belonging to other tenants due to path traversal.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A path traversal vulnerability in IBM API Connect allows an authenticated low-privilege attacker to access or delete resources belonging to other tenants by manipulating URL paths.","exploitability":"Requires valid authentication and low privileges; no user interaction needed, and exploitation is straightforward over the network.","blast_radius":"Compromises tenant isolation, enabling unauthorized data access or deletion across tenants, potentially affecting confidentiality, integrity, and availability of multi-tenant services.","remediation":"Upgrade to IBM API Connect 12.1.1.3 or later, which contains the vendor-provided fix for this path traversal issue.","detection":"Defenders should monitor for HTTP requests containing encoded or unencoded sequences like '..%2f', '%2e%2e/', or similar path traversal patterns in API endpoints handling tenant-specific resources; anomalous access to resources outside the authenticated tenant’s scope in access logs may also indicate exploitation.","tags":["path-traversal","tenant-isolation-bypass","multi-tenant","web-api","cwe-22"],"model":"garnet-coder","analyzedAt":"2026-11-07T10:03:35.858Z"}}