CVE-2026-17238

MediumCVSS 6.4/10Last modified Nov 12, 2026

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to path parameter injection. Values in the request path are not sufficiently validated, which could allow access to data belonging to other tenants.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
IBM	API Connect	>= 12.1.0.0, <= 12.1.1.2; >= 10.0.8.0, <= 10.0.8.12

References

https://www.ibm.com/support/pages/node/7295635Vendor Advisory
https://www.ibm.com/support/pages/node/7295637Patch, Vendor Advisory

Timeline

Published: Nov 7, 2026
Last modified: Nov 12, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-172398.8IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a path traversal vuln CVE-2026-17247.5GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 tha CVE-2026-172405.3IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due t CVE-2026-172416.5IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive inf CVE-2026-172447.4IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform unauthorized CVE-2026-172486.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of spec CVE-2026-17257.5GitLab has remediated an issue in GitLab CE/EE affecting versions from 18.9 before 18.9.1 that could have under certain conditions, allowed CVE-2026-172508.5A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker CVE-2026-172517.1A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attack CVE-2026-172527.1A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP CVE-2026-172557.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of the prefix length in I CVE-2026-172596.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow.