Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:48.710Z",
  "pubdate": "2026-11-07T05:18:48.710Z",
  "executiveSummary": "This vulnerability involves a critical SQL injection flaw within IBM API Connect, identified in versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe vulnerability allows a remote, authenticated attacker to manipulate database queries, leading to unauthorized sensitive information disclosure.\nBy injecting malicious SQL commands into vulnerable application parameters, an attacker can bypass standard data retrieval restrictions to access backend database contents.\nThe impact is significant, as it permits the extraction of sensitive data stored within the API Connect infrastructure, compromising the confidentiality of the environment.\nSuccessful exploitation requires the attacker to have established authentication within the system, after which they can leverage the flaw to interact directly with the database layer.\nGiven the nature of API management platforms, the exposure of backend data can lead to broader security breaches, necessitating immediate patching or risk mitigation.",
  "technicalDetails": "The vulnerability resides in the input handling mechanisms of IBM API Connect, where unsanitized user-supplied input is incorporated into database queries without adequate parameterized query enforcement or input validation.\nRooted in improper neutralization of special elements used in an SQL command, the flaw allows for the alteration of query logic by injecting crafted SQL tokens.\nExploitation is achieved when an authenticated user supplies malicious input to specific API endpoints or management functions that interface with the backend database. By providing input containing SQL syntax, the attacker can manipulate the structure of the resulting query, effectively tricking the database engine into executing unintended operations.\nThe attack flow begins with the identification of a vulnerable input vector that interacts with the backend database. The attacker sends a request containing a crafted payload designed to prematurely terminate or modify the original query structure (e.g., using UNION-based injection or boolean inference). Once the application processes this input, the injected SQL commands are executed within the context of the database server.\nPost-exploitation, the attacker can leverage the injection to bypass row-level security or authorization checks that were meant to restrict data access. This allows for the unauthorized retrieval of rows from tables that the attacker should not otherwise have access to, potentially exposing credentials, API configurations, or sensitive customer data.\nThe vulnerability affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The attack is network-exploitable, requiring that the attacker have sufficient privileges to access the vulnerable API or management interface. No specialized hardware is required, and the exploitation is entirely software-based, performed via standard network communication protocols used by the API Connect system.\nThe persistence of this vulnerability is limited by the attacker's ability to maintain an authenticated session; however, the data exfiltrated during a single successful session can include substantial volumes of sensitive information, often sufficient to elevate privileges or compromise secondary systems connected through the API management gateway."
}