CVE-2026-17398

Overview

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑1.2 allow a remote authenticated attacker to perform server‑side request forgery and exfiltrate sensitive data. The flaw can be exploited over the network by users with valid credentials. It poses a significant confidentiality risk to organizations running these products.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Impact

Confidentiality is compromised as attackers can retrieve sensitive information from internal resources. Integrity may be affected if the attacker can manipulate data via forged requests. Availability is not directly impacted, but the exposure could lead to further attacks. Defenders include system administrators, security teams, and compliance officers.

Remediation

Apply the latest security patch (10.0.8.13 or 12.1.1.3) immediately. If patching is delayed, restrict API Connect to trusted networks, enforce least‑privilege authentication, and monitor for unusual outbound traffic. Disable or isolate any unused internal services that could be targeted by SSRF. Keep logs enabled and review for suspicious request patterns.

Risk context

Severity is high with a CVSS v3 score of 8.5. The vulnerability is exploitable by authenticated users, making it a priority for organizations that rely on IBM API Connect. Timely patching is recommended to mitigate the confidentiality risk.

Affected products

• IBM API Connect 10.0.8
• IBM API Connect 12.1.0