Brief Summary: IBM API Connect CVE-2026-17150, Custom Module Validation Flaw Enabling Cross-Tenant Code Execution

Introduction

IBM API Connect deployments that host several tenants on shared infrastructure have a new isolation problem to address. Uploaded custom module content was not validated thoroughly enough, and an authenticated user could abuse that to run code that reaches beyond their own tenant and into other tenants' sensitive data. IBM rates CVE-2026-17150 at CVSS 3.1 9.9 (Critical). Neither of its bulletins lists a workaround, so the fixed builds 10.0.8.13 and 12.1.1.3 are the only vendor-supported remediation.

IBM API Connect is IBM's integrated API management offering. It covers the creation, securing, management, socialization, and analysis of APIs across their lifecycle. It can run on IBM-managed infrastructure in IBM Cloud, in customer-managed dedicated environments, on third-party clouds, or in hybrid layouts where management components live in IBM Cloud and gateways sit close to backend services. IBM states it was named a Leader in the 2026 Gartner Magic Quadrant for API Management for the 11th consecutive time, which puts API Connect at the center of many enterprise API programs (Gartner itself notes that it does not endorse vendors).

Technical Information

Root cause: a denylist in front of custom module processing

IBM's description is short. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant. A remote authenticated attacker could use this to execute arbitrary code and access sensitive information from other tenants.

The weakness classification is the most informative technical detail IBM has published. IBM maps the issue to CWE-184, Incomplete List of Disallowed Inputs. MITRE defines this as a protection mechanism that rejects inputs prohibited by policy but relies on an incomplete list, so unexpected malicious inputs slip past the intended protection. In practice, the vulnerable code appears to have relied on a denylist, rejecting uploads that matched known bad patterns and accepting everything else. Denylists tend to fail because attackers can find constructs, encodings, or equivalent forms that the list does not cover.

Two cautions apply. First, the CWE explains the general failure mode, not the actual bypass used against API Connect. MITRE's illustrative examples are not evidence that this issue involves those same characters, encodings, or payloads. Second, IBM does not say whether 12.1.1.3 and 10.0.8.13 extend the denylist, switch to an allowlist, or add stronger isolation of module execution per tenant. Any statement about the exact fix mechanism is inference. IBM confirms only that the validation gap is closed in these builds.

Reading the CVSS vector

IBM publishes the following vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AV:N (Network): the attack surface is remote.
AC:L (Low complexity): IBM rates exploitation complexity as low.
PR:L (Low privileges): authentication is required, but the advisory does not identify the exact role.
UI:N (No user interaction): no other user needs to participate.
S:C (Scope changed): the impact extends beyond the vulnerable component's security scope.
C:H / I:H / A:H: high confidentiality, integrity, and availability impact.

Read together, PR:L and S:C mean that requiring a login does not confine the damage to the attacker's own tenant. The changed scope is what describes code from one tenant reaching the shared runtime and other tenants. It also explains why the fix is a platform upgrade rather than a per-tenant setting, since the boundary being enforced sits between one tenant's uploaded code and the shared platform. The documented consequences are arbitrary code execution and access to other tenants' information. The advisory does not establish operating system administrator access or any particular persistence mechanism.

The legitimate feature behind the attack surface

IBM's Developer Portal documentation for API Connect 10.0.8 permits custom modules and Drupal contributed modules. Installation requires administrator access to the Developer Portal and can be done from a URL or by uploading a .tar.gz file. That shows where uploaded module content enters the platform, but it is not the documented exploit path. Do not assume the normal installation role is the exploit prerequisite. The authoritative statement remains IBM's description of a remote authenticated attacker with low privileges.

Attack flow

Based on IBM's published description, exploitation proceeds in three stages:

An authenticated remote attacker supplies custom module content to API Connect.
API Connect processes that content without sufficient validation, because the denylist-style check does not cover the attacker's input.
The resulting code executes with reach beyond the attacker's tenant, exposing other tenants' sensitive information.

That is the full extent of the public mechanism. The advisories do not disclose a malicious module sample, the vulnerable function, the exact request or endpoint, or the specific validation rule that fails. We did not identify a verified public proof of concept.

Exploitation status and timeline

The CVE and NVD records contain no exploitation statement, no threat actor attribution, and no CVE-specific indicators of compromise. The CISA Known Exploited Vulnerabilities feed we inspected (version 2026.11.06) has no matching entry, but that feed was released at 19:44:45 UTC on 6 November 2026, before NVD published the record at 05:18:28 UTC on 7 November 2026. Its silence therefore says nothing about whether CISA has assessed the CVE. The absence of exploitation evidence is an information gap and offers no reassurance.

The disclosure timeline:

3 October 2026: the v12.1.1.3 downloads are listed as published on Fix Central.
5 November 2026: IBM publishes bulletins 7295635 and 7295637.
7 November 2026: the CVE and NVD records are published, with [email protected] as the source.

The NVD score of 9.9 is IBM's CNA rating. NVD has not supplied its own assessment.

Patch Information

IBM has fixed CVE-2026-17150 in two maintenance releases, one per affected release stream. The fix ships only in IBM's proprietary builds. There is no public commit, diff, or source-level patch, so the evidence of the change comes from the two security bulletins and the release notes for the fixed build.

Fixed versions

API Connect V12 (OnPrem): vulnerable v12.1.0.0 through v12.1.1.2, fixed in v12.1.1.3 (IBM bulletin 7295635).
API Connect V10.0.8 (LTS): vulnerable V10.0.8.0 through V10.0.8.12, fixed in 10.0.8.13 (IBM bulletin 7295637).

Both bulletins say IBM "strongly recommends addressing the vulnerability now by upgrading" and both list "None" under Workarounds and Mitigations. No configuration switch, firewall rule, upload filter, or feature-disabling procedure is documented as an alternative.

Delivered as part of a rollup

The fix arrives inside large security rollups. The same bulletins cover more than a hundred other API Connect CVEs, including SSRF, broken object-level authorization, path traversal, and further upload and code-generation issues such as CVE-2026-17399 (unrestricted upload) and CVE-2026-17342 and CVE-2026-17359 (code generation). You cannot take the CVE-2026-17150 fix on its own. Moving to the fixed build applies the whole set, so factor that into change planning and testing.

Obtaining the V12 build

The v12.1.1.3 release page links to entitled Fix Central downloads, including:

The container image tool and operator release files
Management, portal, analytics, and gateway OVA images and upgrade tarballs
apicup install assist and upgrade utilities
12.1.1.3_signatures.zip, a signature bundle for verifying the downloads

The release notes state only that v12.1.1.3 "delivers important security updates." They list six functional defect fixes (for example DT500436 and DT502036), and none is tied to this CVE. For VMware installations, IBM notes that Control Plane files may be required to bring Kubernetes to a supported release level. This is a deployment consideration, not a workaround. IBM's upgrade planning guides for Kubernetes and VMware are linked in the references.

For V10.0.8 installations, bulletin 7295637 links to the API Connect section of Fix Central for the 10.0.8.13 package.

Verifying the fix

With no public diff, verification is by version. A deployment is fixed when every subsystem reports 12.1.1.3 or later (V12) or 10.0.8.13 or later (V10.0.8 LTS).

What not to do

IBM states that directly editing API Connect modules, included modules, themes, or Drupal core on the file system is unsupported, and fixes overwrite edited files. Local patching of product files is therefore not a viable interim measure. The Developer Portal self-service signup workaround from IBM's earlier CVE-2025-13915 advisory addresses a different authentication bypass and does not remedy this flaw. MITRE's general guidance for CWE-184 (prefer mechanisms that identify permitted input, combined with appropriate output encoding) is secure development advice, not an operational instruction for an installed API Connect deployment.

Affected Systems and Versions

IBM API Connect 10.0.8 (LTS): versions 10.0.8.0 through 10.0.8.12
IBM API Connect V12 (OnPrem): versions 12.1.0.0 through 12.1.1.2

These are the ranges NVD records from IBM's CNA data. The vulnerable functionality is the processing of uploaded custom module content, and the risk is greatest where multiple tenants share a deployment. API Connect's broader support for cloud and hybrid deployment does not by itself establish that every managed service or differently numbered release shares this exposure. Scope your assessment to the versions listed in the bulletins.

Vendor Security History

API Connect has had at least one other recent critical disclosure. IBM published a bulletin for CVE-2025-13915 on 17 December 2025, covering an authentication bypass that allowed unauthorized application access, rated CVSS 3.1 9.8 with a vector requiring no privileges. IBM supplied interim fixes and, for customers unable to install them, a workaround to disable Developer Portal self-service signup. Singapore's Cyber Security Agency issued an alert on 2 January 2026 confirming the issue and the availability of IBM updates.

The two cases fail at different boundaries. CVE-2025-13915 concerned entry without authentication and came with a workaround; CVE-2026-17150 concerns an authenticated user escaping their tenant and has no workaround. The lower numeric score of the older issue does not make its unauthenticated entry condition less relevant, and the authentication requirement of the newer one does not confine its impact. Neither advisory establishes an exploit chain connecting the two.

Taken together, these bulletins show a record of disclosed critical API Connect flaws with published corrective updates, plus a large concurrent rollup of more than a hundred CVEs in the current bulletins. That does not establish IBM's overall vulnerability rate or remediation timelines, and market recognition such as the Gartner placement says nothing about how robust tenant isolation is. Patching decisions should rest on the installed release and the applicable fix.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical Information