Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-07T05:18:41.930Z",
  "pubdate": "2026-11-07T05:18:41.930Z",
  "executiveSummary": "IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to an information disclosure vulnerability.\nThe vulnerability arises from the improper logging of sensitive information, which results in the storage of plain-text credentials within system log files.\nThis flaw allows a local attacker, who has gained unauthorized access to the underlying filesystem or log management interface, to extract sensitive authentication data.\nSuccessful exploitation enables the compromise of user and administrative accounts, potentially leading to unauthorized API access, lateral movement, and system-wide security breaches.\nThe risk is categorized as high due to the potential for privilege escalation and the exposure of sensitive security tokens or credentials necessary for maintaining the confidentiality and integrity of the API management infrastructure.\nThis vulnerability requires local access to the affected environment to read the log files.",
  "technicalDetails": "The root cause of this vulnerability is the inadequate sanitization of data before it is written to system logs within the affected IBM API Connect versions.\nDuring normal operational workflows, the application processes sensitive authentication credentials; however, internal logging functions fail to redact or obfuscate these values, resulting in their persistence on the local disk.\nThe vulnerable component is the application's logging subsystem, which captures verbose runtime data that includes sensitive objects, headers, or parameters intended for API request/response processing.\nAttack flow begins with a local attacker identifying a system that allows read access to the application log files stored on the host filesystem.\nBy monitoring these logs or parsing historical log data, an attacker can extract credentials, session tokens, or API keys associated with legitimate users or service accounts.\nExploitation does not require elevated privileges to execute the logging event itself; rather, it requires sufficient local permissions to traverse the directory structure where log files reside.\nOnce the credentials have been exfiltrated, the attacker can leverage these artifacts to impersonate legitimate entities.\nThis can lead to unauthorized access to the API Connect management console or the gateway services, enabling the attacker to manipulate API definitions, modify traffic routing, or access backend services protected by the managed APIs.\nThe exposure persists until the log files are rotated, cleared, or purged, making historical log files a significant target for post-exploitation data mining.\nAffected versions include 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2."
}