Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-11-07T05:18:56.690Z",
  "pubdate": "2026-11-07T05:18:56.690Z",
  "executiveSummary": "IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a critical vulnerability stemming from the presence of hard-coded credentials within the application.\nThis vulnerability allows a remote, unauthenticated attacker to bypass standard security controls and gain full administrative control over the affected system.\nThe risk implication is severe, as the compromise of administrative functions can lead to complete loss of confidentiality, integrity, and availability of the API management infrastructure.\nThe attack does not require specific user interaction or complex exploitation conditions beyond the ability to reach the administrative interface.\nOrganizations deploying these specific versions of IBM API Connect are exposed to unauthorized access, potentially enabling malicious actors to manipulate API definitions, access sensitive configuration data, and intercept or redirect traffic flowing through the API gateway.",
  "technicalDetails": "The vulnerability originates from the embedding of static, hard-coded authentication credentials within the binary or configuration files of the IBM API Connect platform. Hard-coded credentials represent a significant failure in secure development lifecycle practices, as these secrets are immutable by standard user operations and remain consistent across all deployments of the affected software versions.\nThe attack flow begins with an adversary identifying the network endpoint associated with the administrative interface of the IBM API Connect instance. Because the credentials are hard-coded, the attacker does not need to perform brute-force attacks, credential stuffing, or exploit secondary vulnerabilities to establish an initial session.\nUpon identification of the endpoint, the attacker submits a standard authentication request utilizing the discovered hard-coded credentials. The application's authentication backend validates these credentials against the hard-coded values, granting the attacker a session with administrative privileges. This effectively bypasses any existing Identity and Access Management (IAM) controls or multi-factor authentication (MFA) that might otherwise protect the administrative interface.\nOnce administrative access is achieved, the attacker gains full control over the platform's control plane. This level of access permits the adversary to perform several highly sensitive actions, including the extraction of internal cryptographic keys, modification of service policies, redirection of API traffic to rogue endpoints, and the exfiltration of sensitive metadata or backend service connection strings.\nThe vulnerable components are specifically the authentication mechanisms governing the administrative portal of the API Connect suite in the following versions: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The exposure is categorized as a high-severity vulnerability due to the ease of exploitation (zero-interaction) and the absolute nature of the privilege escalation achieved. Post-exploitation, an attacker can maintain persistence by creating new administrative accounts, modifying system logs to obfuscate malicious activities, or injecting backdoors into the API gateway configuration files to ensure long-term, stealthy control over the integrated enterprise service environment."
}