Automated Threat Modeling
Back to Blog

Brief Summary: IBM API Connect CVE-2026-17379 Signature Verification Flaw Allows Authentication Bypass and Arbitrary Role Assignment

A brief summary of CVE-2026-17379, a CVSS 7.4 improper cryptographic signature verification flaw in IBM API Connect that could let a remote attacker bypass authentication and assign arbitrary roles. Covers affected versions and IBM patch information for the V10 and V12 release streams.

CVE Analysis

7 min read

Gaurav Sarraf
Gaurav Sarraf

2026-11-06

Brief Summary: IBM API Connect CVE-2026-17379 Signature Verification Flaw Allows Authentication Bypass and Arbitrary Role Assignment
Experimental AI-Generated Content

This CVE analysis is an experimental publication that is completely AI-generated. The content may contain errors or inaccuracies and is subject to change as more information becomes available. We are continuously refining our process.

If you have feedback, questions, or notice any errors, please reach out to us.

[email protected]

Introduction

IBM API Connect sits in front of the APIs that organizations expose to partners, developers, and internal consumers, so a flaw that lets a remote, unauthenticated attacker bypass authentication and assign arbitrary roles lands directly on the access control layer the product exists to enforce. IBM has shipped fixed releases for both affected release families and lists no workaround, which leaves upgrading as the only vendor-supported path for exposed deployments.

IBM describes API Connect as a platform for managing APIs across their lifecycle: packaging APIs into products, applying governance and access controls, and tracking usage through analytics, with a Developer Portal for API discovery, exploration, and subscription. IBM reports that it was named a Leader in the 2026 Gartner Magic Quadrant for API Management for the 11th time, ranking first in 2 of 5 Critical Capabilities use cases (an IBM reported analyst claim, not a market share figure). Since API Connect enforces governance and access controls over the APIs it manages, a weakness in its authentication and role handling affects the trust boundary for those APIs.

Key facts at a glance:

  • CVE: CVE-2026-17379
  • Weakness: CWE-347, Improper Verification of Cryptographic Signature
  • Severity: CVSS 3.1 base score 7.4 (High), scored by IBM PSIRT
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
  • Affected: 10.0.8.0 through 10.0.8.12, and 12.1.0.0 through 12.1.1.2
  • Fixed: 10.0.8.13 and 12.1.1.3
  • Workarounds: None listed by IBM
  • Exploitation: Not publicly confirmed in reviewed sources

Technical information

Root cause

IBM classifies the vulnerability as CWE-347, which MITRE defines as a product failing to verify, or incorrectly verifying, the cryptographic signature for data. IBM's CVE description supplies the specific consequences: the flaw "could allow a remote attacker to bypass authentication and assign arbitrary roles due to improper verification of cryptographic signatures."

In this kind of bug, the product receives a signed object, such as a token or an identity assertion, and trusts the claims inside it (including role claims) without fully checking the signature. The patched builds should only trust identity and role claims once the signature has been checked against the expected key and algorithm.

That is where the public record stops. IBM has not identified the signed data structure, signature algorithm, validation routine, authentication protocol, component, or request endpoint. The available information therefore does not establish a JWT attack, a SAML attack, a stolen signing key, algorithm substitution, or any particular token manipulation technique. API Connect is closed source, and there is no public commit or source diff, so no vulnerable code can be shown here. We are deliberately not filling that gap with speculation.

Reading the CVSS vector

IBM supplies the vector, which NVD also carries:

  • Attack Vector: Network. The attack is remote.
  • Attack Complexity: High. Per the FIRST CVSS v3.1 specification, successful exploitation depends on conditions beyond the attacker's control. The rating is about exploitation conditions, not attacker skill. IBM does not disclose which conditions drive it.
  • Privileges Required: None. No existing account is needed.
  • User Interaction: None.
  • Scope: Unchanged.
  • Confidentiality: High; Integrity: High; Availability: None.

PR:N together with AC:H means this is an authentication boundary failure that does not require an account, but nothing describes it as something that succeeds at will. The published consequence is authentication bypass plus arbitrary role assignment. Nothing in the disclosure establishes arbitrary code execution, and the impact should not be expanded beyond what IBM states.

The 7.4 score falls in FIRST's 7.0 to 8.9 High band. NVD marks the record "Awaiting Analysis" and identifies [email protected] as the scoring source, so the score belongs to IBM rather than to a completed independent NVD assessment.

Attack flow (conceptual)

The steps below follow the general pattern implied by IBM's description and the CWE-347 class. They are not a validated exploit procedure for this CVE, since no request sequence, payload, or affected interface has been published:

  1. An attacker with network reach to an affected API Connect deployment, holding no credentials (AV:N, PR:N), interacts with the component that consumes signed identity data.
  2. The attacker presents a signed object, such as a token or identity assertion, whose signature the vulnerable build does not properly verify.
  3. The product accepts the identity and role claims inside that object, resulting in authentication bypass and the assignment of roles the attacker chose.
  4. Success also depends on the unspecified conditions behind the High attack complexity rating.

The outcome affects confidentiality and integrity (C:H/I:H) within the vulnerable component's scope.

Exploitation status

Active exploitation is not publicly confirmed. Threat Radar labels CVE-2026-17379 "Not known to be exploited," and IBM's CNA record, its advisories, and NVD contain no exploitation statement. The reviewed sources identified no threat actor attribution, campaign, victim organization, or public proof of concept. CISA KEV inclusion could not be confirmed either way from the available catalog views. Unconfirmed exploitation does not mean attacks have never occurred.

Disclosure timeline:

  • 5 November 2026: IBM security bulletins 7295635 and 7295637 initially published
  • 7 November 2026, 04:34:06 UTC: CNA record published
  • 7 November 2026, 05:18:51 UTC: NVD record published

Patch information

IBM has fixed CVE-2026-17379 only as part of new product releases. There is no standalone hotfix, no public commit, and no source diff. The only public evidence of the fix is two IBM security bulletins published on 5 November 2026, both listed by NVD as the reference advisories for this CVE.

Fixed versions by release stream

Both bulletins give the same direction: IBM "strongly recommends addressing the vulnerability now" by upgrading to the fixed release for your stream. Both also list "Workarounds and Mitigations: None." No configuration setting disables the vulnerable signature check, so upgrading is the only vendor-supported fix. The versions above map each affected stream to its own fix. They are not a recommendation to migrate between release families.

Other fixes in the same release

12.1.1.3 and 10.0.8.13 are cumulative security releases that fix a long list of other API Connect CVEs at the same time. Several of those also concern authentication and token trust:

  • CVE-2026-17301: unauthenticated authentication bypass, also CWE-347.
  • CVE-2026-105459: an organization invitation token accepted without full signature verification.
  • CVE-2026-17290: identity data from a login provider accepted without full signature verification.

You cannot apply only the CVE-2026-17379 fix, because it ships inside the full upgrade, so the whole release needs to be planned and tested. The same upgrade also closes these related signature and token validation flaws.

Deployment notes for V12

IBM's 12.1.1.3 release notice states that the release delivers important security updates and provides separate installation and upgrade artifacts for containers and VMware, along with supporting tools for several operating systems. Full installation files require the appropriate entitlement through Fix Central. For VMware upgrades, IBM notes that Control Plane files may be needed to bring Kubernetes to a supported release level and labels those files optional. This is a deployment-specific consideration, not an exploit prerequisite.

How to confirm you are patched

A system has the fix if its API Connect version is 12.1.1.3 or later (V12 stream) or 10.0.8.13 or later (V10 stream). Any version inside the affected ranges remains exposed.

Affected systems and versions

  • IBM API Connect V12 OnPrem: versions 12.1.0.0 through 12.1.1.2, inclusive
  • IBM API Connect V10: versions 10.0.8.0 through 10.0.8.12, inclusive

The version 12 bulletin specifically identifies API Connect V12 OnPrem. The disclosures do not establish that every IBM-hosted API service or every API Connect component is affected, and IBM does not identify a specific vulnerable configuration beyond the version ranges.

Vendor security history

API Connect has had at least one earlier authentication bypass of note. IBM's bulletin for CVE-2025-13915 states that internal testing revealed a potential authentication bypass that could let a remote attacker bypass authentication mechanisms and gain unauthorized application access. IBM rated it CVSS 9.8, with affected versions 10.0.8.0 through 10.0.8.5 and 10.0.11.0. The bulletin was first published on 17 December 2025 and strongly recommended upgrading, listing iFix resources. InfoWorld and the Cyber Security Agency of Singapore also covered that issue. Nothing in the sources indicates that CVE-2025-13915 and CVE-2026-17379 share a technical cause. The earlier case is context, not an exploitation precedent.

On process, IBM PSIRT centrally handles reports of potential IBM security and AI vulnerabilities using a process influenced by the FIRST framework (discovery, triage, remediation, disclosure), and IBM states it does not disclose or confirm vulnerabilities until analysis is complete and fixes or mitigations are issued. That fits with this CVE arriving alongside fixed releases. Customers can subscribe to IBM My Notifications for security bulletins and report issues through IBM support or [email protected].

References

Follow ZeroPath
ZeroPath on XZeroPath on LinkedIn

Related Articles

Overview of CVE-2026-110932: Unauthenticated Disk Exhaustion via the Keycloak Theme Gzip Cache
CVE Analysis
•

2026-11-05

•

8 min read

Overview of CVE-2026-110932: Unauthenticated Disk Exhaustion via the Keycloak Theme Gzip Cache

A brief summary of CVE-2026-110932, an unauthenticated denial of service in Keycloak where fabricated theme names become keys for a persistent gzip cache on disk, with a short review of the upstream fix shipped in Keycloak 26.8.2 and the current Red Hat status.

Gaurav Sarraf

Gaurav Sarraf

FreeSWITCH CVE-2026-116779: SIP MESSAGE to API Command Injection (PoC, Patch, and Detection)
CVE Analysis
•

2026-11-05

•

11 min read

FreeSWITCH CVE-2026-116779: SIP MESSAGE to API Command Injection (PoC, Patch, and Detection)

A summary of CVE-2026-116779, a critical FreeSWITCH flaw where an inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands. Covers a public PoC, the upstream patch, and log and process based detection leads.

Gaurav Sarraf

Gaurav Sarraf

Brief Summary: FreeSWITCH CVE-2026-116784, an Out-of-Bounds Read in RTCP NACK Feedback Parsing
CVE Analysis
•

2026-11-05

•

8 min read

Brief Summary: FreeSWITCH CVE-2026-116784, an Out-of-Bounds Read in RTCP NACK Feedback Parsing

A brief summary of CVE-2026-116784, an out-of-bounds read in FreeSWITCH's RTCP NACK feedback parser that can crash an instance and terminate every active call. Includes PoC and patch details.

Gaurav Sarraf

Gaurav Sarraf

Detect & fix
what others miss

Book a Demo
Works with
  • GitHub
  • GitLab
  • Bitbucket
  • Azure DevOps Services
  • Gerrit
  • CVS
  • Jira
  • Linear
  • Slack
  • Security Compass
Explore integrations
Security magnifying glass visualization