Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-11-07T05:18:22.440Z",
  "pubdate": "2026-11-07T05:18:22.440Z",
  "executiveSummary": "IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to an XML External Entity (XXE) injection vulnerability. This flaw arises from improper processing of XML input, allowing an unauthenticated remote attacker to manipulate XML parsers to access unauthorized data.\nThe vulnerability occurs when an XML parser is configured to process external entities within an untrusted document. By injecting crafted XML content, an attacker can coerce the application into retrieving local files, internal network resources, or interacting with external systems.\nThe impact includes the potential disclosure of sensitive configuration files, internal system credentials, and unauthorized interaction with backend services accessible to the vulnerable API gateway. This vulnerability poses a significant risk to the confidentiality and integrity of the API management ecosystem, potentially exposing proprietary data or providing an entry point for further lateral movement within the network.\nExploitation does not inherently require prior authentication, making it a critical threat vector for internet-facing API Connect installations. Organizations should prioritize patching to the latest version or implementing strict input validation and XML parser hardening to mitigate this exposure.",
  "technicalDetails": "The vulnerability is classified as an XML External Entity (XXE) injection, residing within the XML parsing logic of IBM API Connect versions 12.1.0.0 through 12.1.1.2. The root cause is the insecure configuration of the XML parser used during the ingestion and processing of incoming requests. Specifically, the parser fails to adequately disable the processing of Document Type Definitions (DTDs) or the resolution of external entities defined within the XML schema.\nIn a standard XXE attack flow, the attacker submits a specially crafted XML document containing a SYSTEM identifier within the DOCTYPE declaration. When the IBM API Connect parser processes this document, it attempts to resolve the external entity. If the parser is configured to permit entity expansion, it retrieves the content located at the URI specified by the attacker.\nThe attack flow follows these steps: 1. The attacker identifies an API endpoint within the IBM API Connect environment that accepts XML-formatted input. 2. The attacker constructs a malicious payload containing an external entity definition, such as <!ENTITY xxe SYSTEM 'file:///etc/passwd'>. 3. This payload is transmitted via a standard HTTP request to the target API endpoint. 4. The vulnerable parser, upon encountering the entity reference, retrieves the contents of the specified system file. 5. The application subsequently returns the contents of the sensitive file in the API response, or potentially uses the retrieved data to perform Server-Side Request Forgery (SSRF) if the URI points to internal network endpoints.\nBecause the vulnerability exists in the core XML processing component, it can be exploited remotely over the network. No specific privileges or authenticated sessions are required if the endpoint is exposed. The impact is significant: beyond local file inclusion (LFI), an attacker can conduct blind XXE attacks to exfiltrate data via out-of-band (OOB) interactions if the application does not return the parsed content directly, or target internal microservices that lack authentication but are reachable from the API Connect gateway. This allows the attacker to bypass perimeter security controls, interact with internal metadata services (e.g., cloud instance identity tokens), and perform reconnaissance on internal infrastructure components that are not otherwise accessible from the public internet."
}