Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.
Published: 2026-11-07
Score: 9.9 Critical
EPSS: n/a
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an LDAP injection flaw that enables a remote authenticated attacker to modify the directory query filter. By injecting malicious input, the attacker can retrieve records from other tenants, gaining unauthorized administrative access to resources outside the owner’s tenant. This compromise threatens confidentiality, integrity, and availability of tenant data.

Affected Systems

The vulnerability affects IBM API Connect deployments running any of the following release ranges: 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2. All tenants configured in these releases are potentially exposed; versions newer than 10.0.8.13 or 12.1.1.3 contain the fix.

Risk and Exploitability

The CVSS score of 9.9 marks it as a critical issue. No EPSS score is available, but the flaw exists in widely deployed releases and requires only authenticated access, which is common in API Connect environments. Although it is not listed in CISA’s KEV catalog, the high severity and cross-tenant impact demand immediate attention. An attacker would need valid user credentials to trigger the LDAP injection, after which elevated privileges are granted across tenant boundaries.

Generated by OpenCVE AI on November 7, 2026 at 07:54 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205 IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all

OpenCVE Recommended Actions

  • Update IBM API Connect to the officially patched releases: 10.0.8.13 or 12.1.1.3, as recommended by IBM.
  • After applying the update, verify that all LDAP queries remain strictly scoped to the tenant and that no cross-tenant results are returned.
  • Apply proper input sanitization or use parameterized LDAP filters to ensure that user-supplied data cannot alter the query structure.

Generated by OpenCVE AI on November 7, 2026 at 07:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-90
CPEs cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:34:17.598Z

Reserved: 2026-07-25T04:37:06.554Z

Link: CVE-2026-17392

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:54.113

Modified: 2026-11-07T05:18:54.270

Link: CVE-2026-17392

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T08:15:02Z

Weaknesses
  • CWE-90

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')