CVE-2026-17108

Overview

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to server‑side request forgery (SSRF) that can be triggered by a remote authenticated attacker. The flaw allows the attacker to send arbitrary requests from the API gateway, potentially exposing sensitive internal resources. This vulnerability is classified as high severity with a CVSS v3 score of 8.5.

Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Impact

Confidentiality is compromised as attackers can retrieve sensitive data from internal services. Integrity may be affected if the attacker can modify outbound requests to alter data flows. Availability is unlikely to be directly impacted, but the exposure of internal endpoints could lead to further exploitation. Defenders should treat this as a significant risk to data protection within the API infrastructure.

Remediation

Apply the latest IBM API Connect patch or upgrade to a version beyond 12.1.1.2. Restrict outbound traffic from the API gateway using firewall rules or network segmentation to limit SSRF reach. Ensure that only authenticated and authorized users can invoke API endpoints, and consider implementing a Web Application Firewall (WAF) to detect and block suspicious request patterns. Monitor logs for anomalous outbound requests and enforce least‑privilege access controls on internal services.

Risk context

The vulnerability is rated high severity with a CVSS v3 score of 8.5. No EPSS data is available, but the lack of a patch for the affected versions increases the urgency for remediation. Defenders should prioritize patching and network hardening to mitigate potential data exposure.

Affected products

• IBM API Connect 12.1.0.0
• IBM API Connect 12.1.1.2