Introduction
IBM API Connect is the component many enterprises rely on to decide who may call their APIs, and CVE-2026-17301 is a flaw in exactly that decision. Because a cryptographic signature is not verified correctly, an unauthenticated attacker could bypass authentication. IBM rates it CVSS 3.1 9.8 and has shipped fixed releases for both affected streams, with no workaround offered in either bulletin.
IBM API Connect is an API management platform for cloud and hybrid deployments. Its gateway secures, controls and mediates API access using authentication and authorization mechanisms including OAuth, OpenID Connect and third-party services. IBM reports that it was named a Leader in the 2026 Gartner Magic Quadrant for API Management for the 11th time, which is a vendor-published statement rather than a market share figure. Because the product sits in front of backend services as an enforcement point, an authentication flaw in it affects the trust boundary for everything behind it.
Technical information
Root cause as disclosed
IBM's description is short: IBM API Connect "could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature." The weakness is classified as CWE-347, Improper Verification of Cryptographic Signature, which MITRE defines as a product failing to verify, or incorrectly verifying, the cryptographic signature for data.
That gives us the causal chain. A signature check that should gate an authentication decision does not hold, so data that should have been rejected is trusted. IBM has not disclosed:
- the signed data format (token type, assertion type or other structure)
- the signature algorithm or key handling behavior
- the affected endpoint or component
- the exact validation error
API Connect is closed source, and IBM has not published a commit, diff or root cause writeup. We therefore cannot show vulnerable code, and we will not reconstruct it.
Common CWE-347 patterns (general, not confirmed for this CVE)
To frame what kind of defect this class usually represents, these are well-documented patterns for CWE-347. IBM has not confirmed any of them as the cause of CVE-2026-17301:
- Trusting the signature algorithm declared by the client, such as JWT
alg: noneor HS/RS algorithm confusion, instead of pinning the expected algorithm on the server. - Decoding and acting on token claims before signature verification completes, or continuing when verification fails.
- Verifying a signature against a key the attacker supplied or selected, for example through
jku,x5uor embedded JWK headers, instead of a trusted key. - Verifying only part of a signed structure, as in XML signature wrapping against SAML.
A correct fix for this class makes verification mandatory and first, accepts only a fixed allowlist of algorithms and trusted keys, and rejects the request outright on failure. IBM's fix should have that effect, but the vendor has not said which pattern applied.
Attack prerequisites from the CVSS vector
IBM, as CNA, publishes CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD does not provide an independent NIST score.
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Unchanged
- Confidentiality, Integrity, Availability: High
Attack flow, within the limits of disclosure
Based on the published description and vector, the scenario looks like this:
- The attacker has network reachability to an affected API Connect deployment (10.0.8.0 through 10.0.8.12, or 12.1.0.0 through 12.1.1.2).
- The attacker holds no account and needs no victim interaction.
- The attacker supplies signed data that the product verifies improperly.
- The authentication decision accepts it, and the attacker is treated as authenticated.
The public sources stop there. There is no reproducible request sequence, payload or proof of concept, and no statement of which authenticated functions become reachable. The high impact ratings describe IBM's severity assessment, not an observed incident. MITRE lists code execution among possible consequences for CWE-347 in general, but that is not evidence that this CVE yields remote code execution. The confirmed impact is authentication bypass.
Disclosure timeline
- 5 November 2026: IBM publishes both security bulletins.
- 7 November 2026, 04:32:52.887 UTC: CNA record published.
- 7 November 2026, 05:18:37.913: NVD publication.
Exploitation status
The reviewed sources do not identify confirmed active exploitation, a named threat actor, a public exploit procedure or indicators of compromise. The latest available official CISA KEV snapshot (version 2026.11.06, released 6 November 2026) predates the CVE's publication, so it cannot settle the CVE's subsequent KEV status in either direction.
Patch information
IBM fixed CVE-2026-17301 by shipping new versions of API Connect. There is no separate hotfix and no public source change. Both bulletins were published on 5 November 2026 and list this CVE.
API Connect 10.0.8.x
- Affected: 10.0.8.0 through 10.0.8.12
- Fixed: 10.0.8.13
- Source: IBM Security Bulletin 7295637, linking to Fix Central for 10.0.8.x
API Connect V12 OnPrem
- Affected: 12.1.0.0 through 12.1.1.2
- Fixed: 12.1.1.3
- Source: IBM Security Bulletin 7295635, linking to the API Connect v12.1.1.3 download page
These are parallel paths, and the V10 bulletin does not ask 10.0.8 customers to migrate to V12. IBM "strongly recommends addressing the vulnerability now" by upgrading, and both bulletins list "None" under Workarounds and Mitigations. IBM does not supply a firewall rule, WAF signature, token configuration change or certificate procedure for this CVE, so upgrading is the only vendor-supported fix.
Related fixes in the same releases
Both 10.0.8.13 and 12.1.1.3 are large rollups, and each bulletin lists more than 100 CVEs. Several are in the same signature and trust area:
- CVE-2026-17379: signature verification flaw allowing authentication bypass and arbitrary role assignment.
- CVE-2026-105459: a token accepted without full signature verification, allowing someone to join an organization without a valid invitation.
- CVE-2026-17290: identity data from a login provider accepted without full signature verification, allowing forged identity data to create accounts.
Because these share a weakness class, piecemeal remediation is not an option. The fixed build is the unit of remediation.
Upgrade planning notes
- Kubernetes, 10.0.8 stream: IBM's upgrade planning guide distinguishes direct upgrades from paths needing an interim upgrade, and requires that the current and target releases support the same Kubernetes version during the API Connect upgrade. Kubernetes can then be moved to the highest version the new release supports.
- VMware: IBM's VMware planning guide covers upgrade requirements and supported paths.
These are deployment planning requirements, not workarounds.
A note on unverified fix names
One upstream source referred to an API Connect 7.13.2 release and to an interim fix for 10.0.8.x. Neither appears in IBM's bulletins for this CVE, so neither should be treated as the fix. The only fixed versions IBM has confirmed are 10.0.8.13 and 12.1.1.3.
Confirming the fix
Check that the deployed version is 10.0.8.13 or later on the 10.0.8 stream, or 12.1.1.3 or later on the V12 stream. The bulletin metadata shows ranges that include the fixed builds ("V10.0.8.0 to V10.0.8.13" and "v12.1.0.0 to v12.1.1.3"). Go by the Affected Products table, which ends at 10.0.8.12 and 12.1.1.2.
Affected systems and versions
- IBM API Connect V10: 10.0.8.0 through 10.0.8.12, inclusive. Fixed in 10.0.8.13.
- IBM API Connect V12 OnPrem: 12.1.0.0 through 12.1.1.2, inclusive. Fixed in 12.1.1.3.
NVD lists the same two ranges. The bulletins do not identify a specific vulnerable configuration or component, so any deployment within these ranges should be considered affected.
Vendor security history
This is not the first publicly documented authentication bypass in API Connect. An IBM bulletin initially published on 17 December 2025 disclosed CVE-2025-13915, which could allow a remote attacker to bypass authentication and gain unauthorized application access. Singapore's Cyber Security Agency reported a CVSS 3.1 score of 9.8 for it. The public descriptions do not establish that the two issues share a root cause or exploitation method, and the current CVE is specifically attributed to improper signature verification.
IBM states that its centralized PSIRT process runs through discovery, triage, remediation and disclosure, and that it does not disclose vulnerabilities until analysis is complete and fixes or mitigations are available. The current bulletins shipped with fixed releases, consistent with that process.
References
- NVD entry for CVE-2026-17301
- Official CVE record (CVE Services API)
- IBM Security Bulletin 7295637 (API Connect 10.0.8.x)
- IBM Security Bulletin 7295635 (API Connect V12 OnPrem)
- IBM API Connect v12.1.1.3 is now available
- IBM Fix Central: API Connect 10.0.8.x
- NVD API record for CVE-2026-17301
- MITRE CWE-347: Improper Verification of Cryptographic Signature
- VulDB entry 432317
- IBM: Planning your API Connect upgrade on Kubernetes (10.0.8 LTS)
- IBM: Planning your API Connect upgrade on VMware (12.1.1)
- IBM Security Bulletin: Authentication bypass in IBM API Connect (CVE-2025-13915)
- Cyber Security Agency of Singapore: Critical Vulnerability in IBM API Connect
- IBM security vulnerability management (PSIRT)
- IBM: What are the benefits of API Connect?
- IBM: 2026 Gartner Magic Quadrant for API Management
- CISA Known Exploited Vulnerabilities Catalog search
- CISA KEV JSON feed
