Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:22.630Z",
  "pubdate": "2026-11-07T05:18:22.630Z",
  "executiveSummary": "This vulnerability involves a Server-Side Request Forgery (SSRF) flaw within IBM API Connect, affecting versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nAn SSRF vulnerability allows a remote, authenticated attacker to induce the server-side application to make unauthorized HTTP requests to arbitrary resources, including internal network infrastructure that is otherwise inaccessible from the public internet.\nThe primary impact of this flaw is the potential exposure of sensitive information residing within the internal environment or the ability to interact with internal services through the API Connect gateway.\nSuccessful exploitation requires the attacker to hold valid authentication credentials for the affected IBM API Connect instance.\nThis vulnerability poses a significant risk to organizational infrastructure, as it enables an attacker to bypass perimeter security controls, probe internal network segments, and potentially perform unauthorized actions against internal APIs, metadata services, or backend databases.\nOrganizations should treat this as a high-priority security concern, given that the gateway architecture is frequently positioned at the edge of the network, making it a critical pivot point for lateral movement.",
  "technicalDetails": "The vulnerability resides in the request handling logic of IBM API Connect, where the application improperly validates or sanitizes user-supplied input used to construct outbound requests to backend resources.\nServer-Side Request Forgery occurs when the application accepts a URL or host component from an authenticated user and performs a request to that destination without adequate network-level restrictions or allow-listing of permitted domains.\nFor the exploitation flow, an authenticated attacker identifies an endpoint or configuration field within the API Connect management or gateway interface that triggers an outbound connection.\nBy manipulating the request parameters, the attacker forces the underlying API Connect service to execute a request on their behalf directed toward internal IP addresses (such as 127.0.0.1 or non-routable internal ranges), internal cloud metadata services (e.g., 169.254.169.254), or other restricted backend management interfaces.\nBecause the request originates from the trusted API Connect server, the target internal service may trust the request implicitly, potentially returning sensitive configuration data, environmental variables, or internal API responses that are otherwise protected by firewall rules.\nThe vulnerability is not restricted to specific HTTP methods; depending on the implementation of the request library used by the product, an attacker may be able to perform GET, POST, or other verb-based requests, which could lead to state-changing actions within internal network components.\nThe impact is magnified by the privileges of the service account running the API Connect process. If the service account has excessive permissions within the cloud or internal environment, the SSRF primitive can be escalated into full cloud service compromise or internal service disruption.\nAffected versions include 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw exists because the application logic fails to perform an exhaustive check against a whitelist of authorized target endpoints, allowing the attacker to bypass the intended network isolation between the public-facing API gateway and the protected internal infrastructure."
}