{"id":"CVE-2026-17392","published":"2026-11-07T05:18:54.113","lastModified":"2026-11-10T05:18:02.240","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-90"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect contains an LDAP injection vulnerability in directory queries that allows an authenticated attacker to manipulate LDAP filters using unsanitized user input, thereby gaining unauthorized administrative access to other tenants' data and resources.","exploitability":"Exploitation requires valid low-privilege authentication and knowledge of how to craft malicious LDAP filter inputs; no public exploit exists, but the attack is straightforward for an attacker with basic LDAP injection experience.","blast_radius":"A successful exploit enables tenant isolation bypass, allowing a compromised low-privilege user to read, modify, or delete data belonging to other tenants—including administrative functions—potentially affecting all tenants sharing the same API Connect instance.","remediation":"Upgrade IBM API Connect to version 10.0.8.13 or later for the 10.0.x branch, or to version 12.1.1.3 or later for the 12.1.x branch, as these versions contain the vendor-provided fix for the LDAP injection flaw.","detection":"Defenders should monitor LDAP query logs for unexpected special characters (e.g., parentheses, ampersands, or pipe symbols) in user-supplied filter components, especially when such queries originate from authenticated but non-administrative API Connect users; anomalous increases in directory query complexity or scope may also indicate exploitation attempts.","tags":["ldap-injection","tenant-isolation-bypass","auth-bypass","ibm-api-connect","cwe-90"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:46:52.261Z"}}