CVE-2026-17299 is a critical (CVSS 9.6) flaw in IBM API Connect: an authenticated remote attacker can read arbitrary files and perform server-side request forgery because the product does not restrict external references in submitted definitions.
What Is It
IBM API Connect does not properly restrict external references when it processes submitted definitions. An attacker with low-privileged authenticated access can put externally referenced content into a definition. The server then resolves it, and the retrieved content can be returned to the attacker.
IBM says this can be used for two things:
- Arbitrary file reads on the affected system.
- Server-side request forgery (SSRF), which makes the server send requests on the attacker's behalf.
The weakness is classified as CWE-918 (Server-Side Request Forgery). IBM's PSIRT published the CVE on 2026-11-07. NVD lists its status as "Awaiting Analysis."
Why It Matters
IBM rates the flaw 9.6 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. In plain terms:
- Network-reachable with low attack complexity.
- Needs only low privileges and no user interaction.
- Scope is changed, so the impact can reach beyond the vulnerable component itself.
- High impact to confidentiality and integrity, and no impact to availability.
API Connect usually sits at the center of an organization's API infrastructure. A flaw that lets a low-privileged user read files and send requests from the server could expose sensitive configuration or internal services. Any account that can submit definitions should be treated as a possible way in.
The sources cited here do not say whether CVE-2026-17299 is in CISA's Known Exploited Vulnerabilities (KEV) catalog, and they do not confirm active exploitation. Readers should check the KEV catalog directly for its current status.
What's Vulnerable
IBM lists these versions of IBM API Connect as affected:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
Organizations running any release in these ranges should treat their deployments as exposed.
Patch Status
IBM has published two support advisories for this vulnerability (linked below). The NVD record does not name fixed versions or specific workarounds. Administrators should check the IBM advisories for upgrade paths and mitigation guidance for their release line.
Federal agencies should check the KEV catalog to find out whether any required action or remediation due date applies. Until fixes are applied, organizations should review who has permission to submit definitions to API Connect.