External risk intelligence

IBM API Connect Broken Object Level Authorization Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-17338

IBM API Connect is a platform specifically designed to manage, deploy, and expose APIs to the internet or external partner networks. As an API gateway and management solution, it is commonly deployed in public-facing or edge-adjacent roles to facilitate external connectivity, making its services and interfaces commonly reachable from the internet in standard deployment patterns.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical security vulnerability in IBM API Connect. The issue, stemming from flawed authorization controls, could allow authenticated users to access sensitive information. While the exact business impact is under investigation, understanding its relevance to your API management infrastructure is important.

Flawed authorization allows access to sensitive data.
Affects API management, potentially exposing sensitive information.
Confirm relevance and exposure within your systems.

Attack Path

How an attacker could exploit the issue

An attacker with existing credentials could exploit this vulnerability by sending a specially crafted request to the API Connect gateway. This request would bypass authorization checks, allowing the attacker to access sensitive information that should not be exposed.

Attacker must be authenticated.
Triggered by sending a malicious API request.
Risk of sensitive information exposure.

Live Threat

Current exploitation, exposure, and threat context

IBM API Connect, when configured to expose APIs, could allow an authenticated user to access sensitive information and potentially affect the integrity or availability of the service. This could occur when the system's object-level authorization is improperly handled, permitting unauthorized access to specific API resources.

Sensitive information within API configurations or managed data.
When an authenticated user accesses specific API endpoints.
Unauthorized data disclosure or service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the nature of IBM API Connect as an API management platform, application owners, platform teams, and potentially network/security teams are likely responsible for addressing this vulnerability. The first practical step is to identify all instances of IBM API Connect within your environment, determine their exposure and business criticality, and confirm the accountable owner for each deployment before planning remediation.

Identify and confirm accountable owners.
Verify external exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM API Connect?

IBM API Connect is a comprehensive platform used by organizations to create, manage, secure, and monitor application programming interfaces (APIs). It acts as a gateway that controls how internal and external services communicate, ensuring that data exchanges between applications are routed, regulated, and governed according to business policies.

What does broken object-level authorization mean in CVE-2026-17338?

This vulnerability, classified as CWE-639, occurs when an application fails to properly verify if the person requesting access to a specific data object—like a record or resource—is authorized to view or modify it. Even if a user is logged in, the system incorrectly trusts them to access resources belonging to other users or sensitive system configurations.

How does an attacker trigger this vulnerability?

An attacker must already have valid credentials to interact with the API gateway. The vulnerability is triggered by sending a specially crafted request that targets specific API endpoints. Simply being an authenticated user is not enough; the attacker must intentionally bypass security checks by manipulating the request, which then convinces the system to reveal information that should have remained protected.

Do I need to worry if my IBM API Connect is not internet-facing?

Halo Surface Signal indicates that this software is frequently deployed in edge-adjacent or public-facing roles to facilitate external connectivity. While the vulnerability remains a risk for internal deployments if an authenticated user acts maliciously, internet-facing instances are at a higher priority due to their broader accessibility to potential external threats.

What should I do first to address this CVE?

Begin by auditing your infrastructure to locate every instance of IBM API Connect within your environment. Once identified, document which teams own each deployment, assess the business criticality of the data they handle, and evaluate the network exposure for each instance to prioritize your remediation efforts effectively.

References

www.ibm.com/support/pages/node/7295635

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.