CVE-2026-17291 — Ibm Api Connect
HIGHCVE-2026-17291 is a high-severity (CVSS 8.7) Open Redirect vulnerability in ibm api connect. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability.…
Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.
Affected Products
api connectibmDetection & mitigation playbook
Vendor / applianceDetect
Inventory every ibm api connect deployment and check each version against the affected-products list above.
Remediation status
The records we use list no fixed version for CVE-2026-17291. Check the ibm api connect advisory for a patched release, and apply the workarounds below until you can upgrade.
Mitigate without a patch
Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-17291 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.