CVE-2026-16912

Overview

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 are vulnerable to a server-side request forgery that allows a logged-in attacker to read sensitive data. The flaw can be triggered by crafted API calls and does not require elevated privileges beyond normal user accounts. This can expose internal network resources and confidential configuration information.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Impact

Confidentiality is compromised as attackers can retrieve internal URLs, credentials, or other sensitive data. Integrity is at risk if the attacker can modify requests to internal services. Availability is not directly affected, but the breach could lead to further exploitation. Defenders should assume that any authenticated user could be a threat actor.

Remediation

Apply the official IBM security patch or upgrade to a fixed release (10.0.8.13 or later, 12.1.1.3 or later). If patching is delayed, restrict API Connect’s outbound traffic to known internal hosts, enable strict request validation, and monitor for unusual outbound requests. Additionally, enforce least-privilege for API users and audit API call logs.

Risk context

Severity is high with a CVSS v3 score of 8.5. No EPSS data is available, but the lack of a public exploit does not reduce the urgency; defenders should act promptly to mitigate potential data exposure.

Affected products

• IBM API Connect 10.0.8
• IBM API Connect 12.1.0