Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:57.670Z",
  "pubdate": "2026-11-07T05:18:57.670Z",
  "executiveSummary": "This vulnerability is a critical SQL injection (SQLi) flaw identified in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe vulnerability originates from the improper sanitization of user-supplied data during the authentication process, specifically within the sign-in mechanism.\nA remote, authenticated attacker can exploit this weakness to inject and execute arbitrary SQL commands directly against the backend database management system.\nThe impact of a successful exploit is severe, potentially allowing unauthorized data extraction, modification of database contents, and administrative control over the backend data layer.\nExploitation requires the attacker to have an active authenticated session or access to the sign-in interface, effectively bypassing application-level input validation controls.\nGiven the nature of API Connect as an integration gateway, this vulnerability poses significant risks to the integrity, confidentiality, and availability of the entire API ecosystem it governs.",
  "technicalDetails": "The vulnerability exists within the input handling logic of the IBM API Connect authentication component. The root cause is the failure to adequately neutralize or sanitize input parameters received during the sign-in sequence before these values are concatenated into dynamic SQL queries executed by the backend database.\nThe attack flow begins when an attacker submits specially crafted input, containing SQL control characters or clauses, through the authentication endpoint. Because the application fails to utilize parameterized queries or prepared statements, the database engine interprets the malicious input as part of the intended SQL command structure.\nBy manipulating these input fields, an attacker can perform a variety of SQL injection techniques, such as UNION-based injection to exfiltrate data from other tables, boolean-based blind injection to infer database schema information, or even error-based injection to reveal diagnostic details about the application environment.\nThe vulnerable component is identified as the authentication/sign-in processing module. The specific affected versions include IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The exploit path is accessible over the network, and the primary requirement for successful exploitation is the ability to interact with the sign-in interface, usually necessitating authenticated access to the system.\nOnce the injected SQL payload is processed, the database executes the attacker-defined commands within the security context of the database service account. This post-exploitation capability can lead to unauthorized data retrieval, sensitive record manipulation, or modification of application configuration stored within the database.\nThe payload behavior is dependent on the specific database backend implemented by the IBM API Connect deployment, as syntax varies between SQL dialects. An attacker may leverage this to bypass authentication logic, elevate their privileges within the API Connect management plane, or potentially achieve remote code execution if the database configuration permits features such as xp_cmdshell or equivalent procedural capabilities."
}