high · CVSS v3 8.5

CVE-2026-17397

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑12.1.1.2 are vulnerable to a server‑side request forgery that can be exploited by authenti

Overview

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑12.1.1.2 are vulnerable to a server‑side request forgery that can be exploited by authenticated users to read sensitive data. The flaw allows attackers to trick the server into making requests to internal resources, exposing confidential information. Prompt patching is essential to prevent data leakage.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Impact

Confidentiality: attackers can read internal data. Integrity: potential to read or modify internal resources. Availability: not directly impacted. Defenders: system administrators and security teams managing IBM API Connect deployments.

Remediation

Apply the latest IBM API Connect patch that addresses CVE-2026-17397. If patching is delayed, restrict API Connect to trusted networks, enforce strict outbound request filtering, and monitor for anomalous outbound traffic. Disable or limit user roles that can trigger internal requests.

Risk context

Severity is high with CVSS 8.5, indicating significant risk. No EPSS data available, but the vulnerability can be exploited by authenticated users, making it a priority for organizations running the affected IBM API Connect versions.

Affected products

  • IBM API Connect 10.0.8.0‑10.0.8.12
  • IBM API Connect 12.1.0.0‑12.1.1.2

Scores

Severity
high
CVSS v2
7.5
CVSS v3
8.5
CVSS v4
—
EPSS
—

SSRF IBM API Connect Data Leakage Authentication High Severity

← All CVEs

Related CVEs

high

CVE-2026-16715

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 have a broken object-level authorization flaw that lets a remote authenticated user read data belonging to other tenants. This can expose sensitive tenant data and compromise isolation boundaries. The vulnerability is rated high with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16717

IBM API Connect versions 12.1.0.0 to 12.1.1.2 have a flaw that allows authenticated attackers to bypass object-level authorization and access sensitive data. The vulnerability can lead to data exposure and compromise of confidential information. It is rated high severity with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16718

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑12.1.1.2 are vulnerable to a remote authenticated information disclosure due to improper file path validation. An attacker with valid credentials can read sensitive files on the host. This can expose configuration, credentials, or other confidential data.

View analysis

high

CVE-2026-16854

IBM API Connect 12.1.0.0 through 12.1.1.2 is vulnerable to a remote authenticated injection that can expose data from other tenants. The flaw allows attackers to craft queries that return unauthorized sensitive information. This impacts multi-tenant deployments where tenant isolation is critical.

View analysis