Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow arbitrary code to be executed by the management service in certain non-default configurations due to improper control of generation of code. Customization content may be evaluated as code, which is only possible where the related feature is enabled and not properly restricted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-07T05:17:57.570Z",
  "pubdate": "2026-11-07T05:17:57.570Z",
  "executiveSummary": "This vulnerability involves improper control of code generation within the management service of IBM API Connect. The flaw allows for arbitrary code execution in specific non-default configurations where customization features are enabled.\nThe vulnerability type is categorized as Improper Control of Generation of Code, which effectively functions as an arbitrary code execution vulnerability. Affected versions include IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe risk implication is critical, as successful exploitation permits an authenticated attacker with sufficient privileges to execute arbitrary commands or scripts on the management service host. This facilitates full system compromise, unauthorized data access, and potential lateral movement within the environment.\nThe exploitation requirement is contingent upon the activation of specific, non-default customization features that lack sufficient input sanitization or restrictive controls. Attackers must be able to influence the customization content evaluated by the management service, meaning the vulnerability is limited to environments that have opted into these specific configurations.",
  "technicalDetails": "The root cause of this vulnerability lies in the management service's handling of customization content. When specific non-default features are enabled, the application fails to adequately isolate or sanitize user-provided or administrative customization inputs before they are processed by the underlying engine.\nThe management service functions as a critical component of the API Connect architecture, responsible for orchestrating management tasks. The vulnerability exists because the service evaluates customization content as executable code rather than strictly interpreted data. If an attacker can inject malicious code into these customization objects, the service inadvertently interprets and executes that payload with the privileges of the management service process.\nThe attack flow commences with the attacker identifying an enabled, non-default feature that supports customization. The attacker then crafts a malicious payload—typically containing syntax recognized by the evaluation engine—and injects it via an interface intended for legitimate customization. Upon the system’s reconciliation or refresh cycle, the management service retrieves the stored customization object and proceeds to evaluate it. Because the input is not properly restricted or sandboxed, the evaluation process triggers the execution of the injected code.\nVulnerable versions include 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. Exploitation typically requires high-level administrative or privileged access to the management interfaces where customization occurs. The network exposure is generally restricted to the management plane; however, once code execution is achieved, the attacker operates within the context of the service account, granting them unrestricted access to the local operating system, internal configuration files, and API management metadata.\nThe post-exploitation impact is severe. Since the management service holds high-level privileges, an attacker can modify API configurations, extract sensitive secrets, disable security policies, or establish persistent backdoors on the management appliance. The vulnerability effectively turns a configuration management interface into an entry point for arbitrary server-side execution, bypassing intended security boundaries provided by the API gateway and associated management microservices."
}