Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-11-07T05:18:22.803Z",
  "pubdate": "2026-11-07T05:18:22.803Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in IBM API Connect, affecting versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThis vulnerability allows a remote, unauthenticated attacker to manipulate the application into sending arbitrary outbound requests to unintended destinations.\nBy leveraging the server's identity, an attacker can bypass network perimeters, interact with internal APIs, or probe internal network resources that are otherwise inaccessible from the public internet.\nThe risk implication is significant as it potentially facilitates unauthorized data access, internal reconnaissance, and interaction with sensitive backend services within the IBM API Connect environment.\nSuccessful exploitation requires the attacker to send specially crafted requests to the vulnerable component, enabling the server to proxy these requests to internal targets.\nOrganizations using the specified versions are at risk of unauthorized resource exposure and should prioritize remediation efforts to mitigate potential exploitation.",
  "technicalDetails": "The vulnerability is categorized as a Server-Side Request Forgery (SSRF) flaw, originating from improper input validation and insufficient sanitization of user-supplied URLs within the API Connect infrastructure.\nThe root cause lies in the application's failure to adequately restrict or validate the target destinations when it performs outbound HTTP requests on behalf of a user. When an attacker provides a manipulated input, the application may fail to enforce a whitelist or deny-list, permitting the request to be routed to local services, internal loopback addresses, or sensitive internal network endpoints.\nThe attack flow typically begins with an attacker identifying an endpoint within the IBM API Connect platform that initiates outbound network connectivity. The attacker transmits a crafted request, often containing a malicious URL pointing to an internal target (e.g., http://127.0.0.1:port or internal infrastructure addresses).\nUpon receipt, the vulnerable component processes the request without sufficient validation. The server then acts as a proxy, executing the outbound request against the targeted internal resource. Because the request originates from the server itself, the security controls usually enforced at the network perimeter are bypassed, as the internal service views the request as trusted traffic originating from within the local environment.\nThe impact of this exploitation includes the ability for an attacker to conduct internal port scanning, fingerprint internal services, or interact with backend management interfaces that lack secondary authentication layers. In some instances, it may allow the retrieval of sensitive metadata or configuration data from internal cloud services, depending on the network architecture and environment permissions.\nThis vulnerability does not require authentication to trigger, as the entry point is exposed to remote actors. The scope of exploitation is limited by the server's network configuration and the specific implementation of the outbound request handler within the API Connect subsystem. Post-exploitation, an attacker can maintain persistence in probing the internal network, potentially chaining the SSRF to gain further access to internal services or API resources."
}