Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:24.760Z",
  "pubdate": "2026-11-07T05:18:24.760Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in IBM API Connect versions 12.1.0.0 through 12.1.1.2.\nThe vulnerability resides within the application's request handling mechanisms, allowing a remote authenticated attacker to influence server-side requests.\nBy manipulating the API, an attacker can coerce the server to interact with unintended internal or external resources, potentially leading to unauthorized data exfiltration or access to internal network services.\nThis vulnerability requires the attacker to possess authenticated access to the API Connect environment, limiting the threat surface to users with valid credentials.\nThe primary risk implication is the potential exposure of sensitive internal configuration data, metadata, or backend services that are otherwise protected from direct public access.\nOrganizations using the specified versions of IBM API Connect are advised to review access controls and monitor for anomalous outbound traffic patterns originating from the API gateway components.",
  "technicalDetails": "The identified vulnerability in IBM API Connect (12.1.0.0 through 12.1.1.2) is a Server-Side Request Forgery (SSRF) that enables an authenticated remote attacker to perform unauthorized requests by proxying through the application server.\nThe root cause of this SSRF is improper input validation of parameters that are subsequently utilized by the server to construct and execute HTTP requests to remote destinations. When the application logic fails to properly sanitize or constrain the user-provided URLs or destination hosts, it allows the server to be directed to interact with arbitrary endpoints.\nIn a typical attack flow, the authenticated user identifies an API endpoint or management function within the IBM API Connect interface that processes user-supplied data to fetch remote content. By supplying a malicious URI—such as an address pointing to internal metadata services, management interfaces, or unintended third-party hosts—the attacker forces the server to initiate an outbound request using the server's own network identity and privileges.\nBecause the server initiates these requests, the server-side environment acts as a proxy for the attacker. This bypasses network-level access controls and firewalls that would normally restrict direct access to internal network infrastructure from the public internet. If the target system trusts the API Connect instance based on its IP address or existing security policy, the attacker can successfully pivot into protected network segments.\nThe exploitation process involves the attacker authenticated as a legitimate user interacting with the API gateway. The attacker identifies the vulnerable function and submits a request containing the target URI in a parameter intended for remote resource retrieval. The server fails to enforce an allowlist of permitted hosts or schemas, resulting in the server executing a request to the attacker's specified destination. The resulting response—or confirmation of connection—is then potentially relayed back to the attacker or used to gather intelligence about the backend infrastructure.\nPost-exploitation impact includes the ability for the attacker to perform internal port scanning, query cloud instance metadata services (like the AWS/Azure IMDS if deployed in the cloud), or access internal APIs that lack secondary authentication layers. Given that the API Connect instance is often integrated into the core of an enterprise's service-oriented architecture, this SSRF represents a significant risk to the integrity and confidentiality of internal backend data and auxiliary services."
}