IBM Api Connect
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in IBM Api Connect.
By the Year
In 2026 there have been 210 vulnerabilities in IBM Api Connect with an average score of 7.6 out of ten. Last year, in 2025 Api Connect had 1 security vulnerability published. That is, 209 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 2.20
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 210 | 7.60 |
| 2025 | 1 | 9.80 |
| 2024 | 0 | 0.00 |
| 2023 | 3 | 7.27 |
| 2022 | 1 | 5.40 |
| 2021 | 14 | 6.37 |
| 2020 | 7 | 6.40 |
| 2019 | 25 | 7.40 |
| 2018 | 17 | 5.93 |
It may take a day or so for new Api Connect vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent IBM Api Connect Security Vulnerabilities
IBM API Connect 10.0.8.x/12.1.0.x ReDoS & wildcard query vulnerability
CVE-2026-18535
9.6 - Critical
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.
ReDoS
IBM API Connect 10.0.8.x Hardcoded Key Credential Decryption
CVE-2026-19124
6.8 - Medium
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 could allow an attacker with access to stored data to decrypt sensitive credentials due to the use of a hard-coded cryptographic key. The key protecting stored credentials is built into the product, so credentials could be decrypted if the stored data is obtained.
Use of Hard-coded Credentials
IBM API Connect <=10.0.8.12 Weak PRNG Info Disclosure
CVE-2026-17393
5.1 - Medium
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a local attacker to obtain sensitive information due to the use of a cryptographically weak pseudo-random number generator.
PRNG
IBM API Connect 10.0.8.0-10.0.8.12 Remote Admin via Weak PRNG
CVE-2026-17386
8.1 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote attacker to gain full administrative control due to the use of a cryptographically weak pseudo-random number generator.
PRNG
IBM API Connect 10.0.8.0-10.0.8.12 SSRF Auth Remote Info Disclosure
CVE-2026-17384
8.5 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.
SSRF
IBM API Connect 12.1.0.0-12.1.1.2 SSRF via request bypass
CVE-2026-75590
7.2 - High
- November 07, 2026
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses.
SSRF
IBM API Connect 12.1.0.0-12.1.1.2 Auth Bypass via Index Query
CVE-2026-19131
6.5 - Medium
- November 07, 2026
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow low-privileged users to query arbitrary indices and read sensitive data due to missing authorization.
AuthZ
IBM API Connect 10.0.8.12/12.1.1.2 Backup Server MITM via identity check flaw
CVE-2026-19129
6.8 - Medium
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a network-positioned attacker to intercept backup data due to improper verification of the backup server's identity. The identity of the backup server is not verified when the secure connection for analytics backups is established, which could allow backup data, and credentials if used, to be intercepted.
Improper Certificate Validation
IBM API Connect 12.1.0.0-12.1.1.2 Authenticated SSRF
CVE-2026-19128
7.5 - High
- November 07, 2026
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.
SSRF
IBM API Connect <=12.1.1.2 Weak Crypto Allows Decryption
CVE-2026-19126
5.9 - Medium
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Use of Password Hash With Insufficient Computational Effort
IBM API Connect <=12.1.1.2 SSRF via auth privileged attacker
CVE-2026-19122
3.8 - Low
- November 07, 2026
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated privileged attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.
SSRF
IBM API Connect 12.1.0.012.1.1.2 Auth Bypass (Tenant Escalation)
CVE-2026-19121
8.3 - High
- November 07, 2026
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.
Authentication Bypass by Spoofing
IBM API Connect 12.1.0.012.1.1.2 Auth Bypass Info Disclosure/Config Modify
CVE-2026-18838
9.4 - Critical
- November 07, 2026
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user.
Authentication Bypass by Spoofing
IBM API Connect 10.0.812.1.1.2 SSRF (CVE202618836)
CVE-2026-18836
9.3 - Critical
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
SSRF
IBM API Connect 10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2 Auth Token Bypass Info Leak
CVE-2026-18689
4.3 - Medium
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
AuthZ
IBM API Connect <=10.0.8.12, <=12.1.1.2 Auth Bypass Info Leak
CVE-2026-17428
5 - Medium
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
Insecure Direct Object Reference / IDOR
IBM API Connect <=10.0.8.12, <=12.1.1.2 Authenticated SQLi
CVE-2026-17411
7.6 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
SQL Injection
IBM API Connect <10.0.8.13 / <12.1.1.3> Portal Data Access via Arg Delimiter Bypass
CVE-2026-17410
9.9 - Critical
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
Argument Injection
IBM API Connect 10.0.8.x & 12.1.012.1.1.2 Authz Bypass (Casesensitivity)
CVE-2026-17409
9.4 - Critical
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
Improper Handling of Case Sensitivity
IBM API Connect 10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2 OS Cmd Injection
CVE-2026-17408
9.8 - Critical
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
Shell injection
IBM API Connect 10.0.8.x/12.1.0.x SQLi in Signin
CVE-2026-17407
8.5 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
SQL Injection
IBM API Connect 10.0.8.012.0.8.12 & 12.1.0.012.1.1.2 SSRF Auth Bypass
CVE-2026-17406
8.5 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
SSRF
IBM API Connect <10.0.8.12,12.1.1.2 Broken ObjLevel Auth in Keystore
CVE-2026-17405
8.8 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
Insecure Direct Object Reference / IDOR
IBM API Connect 10.0.8.0-10.0.8.12/12.1.0.0-12.1.1.2 SSRF Auth Info Leak
CVE-2026-17404
8.5 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
SSRF
IBM API Connect 10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2 Hard-coded creds Remote Admin
CVE-2026-17403
9 - Critical
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
Use of Hard-coded Credentials
IBM API Connect 10.0.8.12 & 12.1.1.2 OS Cmd Injection
CVE-2026-17402
9.9 - Critical
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
Shell injection
IBM API Connect <=10.0.8.12 & <=12.1.1.2 Stack Buffer Overflow
CVE-2026-17401
7.2 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
Stack Overflow
IBM API Connect 10.0.8.x & 12.1.0.x Authenticated SQLi Info Disclosure
CVE-2026-17400
7.7 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
SQL Injection
IBM API Connect Auth RCE via Unchecked Upload (10.0.8.0-10.0.8.12,12.1.0.0-12.1.1.2)
CVE-2026-17399
9.9 - Critical
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.
Unrestricted File Upload
IBM API Connect <=10.0.8.12 & <=12.1.1.2 SSRF Info Leak
CVE-2026-17398
8.5 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
SSRF
IBM API Connect 10.0.8.0-10.0.8.12 & 12.1.0.0-12.1.1.2 SSRF (auth)
CVE-2026-17397
8.5 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
SSRF
IBM API Connect 10.0.812.0.8.12 & 12.1.012.1.1.2 Auth SQLi Info Leak
CVE-2026-17396
9.6 - Critical
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
SQL Injection
IBM API Connect 10.0.8.x12.1.1.2 SSRF via URL Validation
CVE-2026-17395
6.4 - Medium
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the server to be made to contact internal systems.
SSRF
IBM API Connect 10.0.8.012.0.8.12 & 12.1.0.012.1.1.2 Improper Access Control
CVE-2026-17394
9.6 - Critical
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.
Mass Assignment
IBM API Connect 10.0.8.0-10.0.8.12 /12.1.0.0-12.1.1.2 LDAP Injection Admin Access
CVE-2026-17392
9.9 - Critical
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.
LDAP Injection
IBM API Connect <=10.0.8.12,12.1.1.2 AuthZ Bypass Sensitive Info Leak
CVE-2026-17391
6.3 - Medium
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
Insecure Direct Object Reference / IDOR
IBM API Connect <10.0.8.12, 12.1.1.2> XSS in Web UI (Auth)
CVE-2026-17390
6.4 - Medium
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session.
XSS
IBM API Connect 10.0.8.x/12.1.0.x LDAP Injection Info Disclosure
CVE-2026-17389
5.3 - Medium
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory lookups, which could cause queries to return additional data.
LDAP Injection
IBM API Connect <10.0.8.12,12.1.1.2> Obj Authz Bypass Info Disclosure
CVE-2026-17388
8.5 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
Insecure Direct Object Reference / IDOR
IBM API Connect 10.0.8.0-10.0.8.12 & 12.1.0.0-12.1.1.2 BOLA auth bypass
CVE-2026-17387
7.7 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
Insecure Direct Object Reference / IDOR
IBM API Connect <=10.0.8.12, <=12.1.1.2 SSRF Vulnerability (CVE-2026-17385)
CVE-2026-17385
8.5 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
SSRF
IBM API Connect 10.0.8.x & 12.1.0.x BOLA tenant data leak
CVE-2026-17383
7.7 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.
Insecure Direct Object Reference / IDOR
IBM API Connect <10.0.8.13 & <12.1.1.3 Authenticated Path Traversal
CVE-2026-17382
8.5 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
Directory traversal
IBM API Connect <10.0.8.12,12.1.1.2> Authz Bypass Info Disclosure
CVE-2026-17381
8.5 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys.
Insecure Direct Object Reference / IDOR
IBM API Connect Path Traversal (<=10.0.8.12, <=12.1.1.2)
CVE-2026-17380
8.5 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access sensitive information belonging to other tenants due to improper validation of a path parameter. A path value in a request is not sufficiently validated, which could allow a user to reach data outside their own tenant.
Directory traversal
IBM API Connect <=10.0.8.12, <=12.1.1.2 Auth Bypass via Sig Verification
CVE-2026-17379
7.4 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and assign arbitrary roles due to improper verification of cryptographic signatures.
Improper Verification of Cryptographic Signature
IBM API Connect 10.0.8.x/12.1.0.x Authz Bypass (CVE202617378)
CVE-2026-17378
7.7 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
AuthZ
IBM API Connect <=10.0.8.12, <=12.1.1.2 Log Record Forgery
CVE-2026-17377
5 - Medium
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to forge audit records due to improper output neutralization for logs.
Improper Output Neutralization for Logs
IBM API Connect Auth ObjLevel Bypass (10.0.8.012.1.1.2)
CVE-2026-17376
7.7 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
Insecure Direct Object Reference / IDOR
IBM API Connect 10.0.8.x & 12.1.0.x Auth Bypass (Improper AuthZ)
CVE-2026-17375
7.7 - High
- November 07, 2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization decisions rely on information supplied by the client, which could allow access to information the user should not see.
Insecure Direct Object Reference / IDOR
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for IBM Api Connect or by IBM? Click the Watch button to subscribe.
