LDAP Injection Vulnerability in IBM API Connect
CVE-2026-17389

5.3MEDIUM

Key Information:

Vendor

IBM
Status
Api Connect
Vendor
CVE Published:
7 November 2026

What is CVE-2026-17389?

The vulnerability in IBM API Connect allows a remote attacker to exploit improper input handling during directory lookups, which may result in the extraction of sensitive information from the connected LDAP directory. This flaw arises when user input is not properly sanitized, potentially allowing unauthorized access to additional data through manipulated queries.

Affected Version(s)

API Connect 12.1.0.0 <= 12.1.1.2

API Connect 10.0.8.0 <= 10.0.8.12

References

https://www.ibm.com/support/pages/node/7295635
vendor-advisorypatch
https://www.ibm.com/support/pages/node/7295637
vendor-advisorypatch

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.