Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-11-07T05:18:26.230Z",
  "pubdate": "2026-11-07T05:18:26.230Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in IBM API Connect versions 12.1.0.0 through 12.1.1.2.\nThis vulnerability allows an unauthenticated or remote attacker to manipulate the server into initiating outbound HTTP requests to arbitrary, unintended destinations.\nBy bypassing existing restrictions on outbound communication, the attacker can force the application to interact with internal resources or external services that would otherwise be inaccessible from the client's perspective.\nThe primary risk associated with this flaw is the unauthorized disclosure of sensitive information, as the application returns the responses from these forged requests back to the attacker.\nSuccessful exploitation compromises the integrity of the application's network perimeter, potentially exposing metadata services, internal microservices, or private network infrastructure to malicious interaction.",
  "technicalDetails": "The vulnerability resides in the request processing mechanism of IBM API Connect versions 12.1.0.0 through 12.1.1.2, which fails to adequately sanitize or validate user-supplied input used in outbound service requests.\nThis flaw manifests as a Server-Side Request Forgery (SSRF), where the server acts as an intermediary or proxy for requests crafted by an attacker.\nThe root cause is the insufficient implementation of outbound traffic controls, allowing for the circumvention of established destination blacklists or permit-lists. Because the application logic fails to enforce strict bounds on the target URI, an attacker can manipulate the request parameters to force the server to perform GET or POST requests against arbitrary internal or external hosts.\nThe attack flow proceeds as follows: 1) The attacker identifies an API endpoint or function within IBM API Connect that triggers an outbound network request as part of its standard operations. 2) The attacker submits a specially crafted request to this endpoint, replacing the legitimate target URL with a target of their choosing (e.g., internal loopback addresses like 127.0.0.1 or internal network CIDR blocks). 3) The backend server processes the input without verifying the destination, subsequently initiating a connection to the malicious or unintended target. 4) The server receives the response from the targeted destination and propagates this data back to the attacker through the initial application interface.\nThe vulnerability is particularly critical due to the potential for interaction with local service discovery interfaces or internal management APIs that may rely on implicit trust for requests originating from the localhost. This allows an attacker to bypass firewalls and network segmentation policies by utilizing the vulnerable server as a pivot point. The payload typically involves modifying parameters within the request body or header that control the downstream service target. There is no indication that authentication is required to trigger this vulnerability, significantly lowering the barrier for exploitation. The impact extends beyond simple information disclosure, as an attacker could potentially perform port scanning, cross-protocol exploitation, or interact with administrative interfaces residing within the internal network segment where the IBM API Connect instance is deployed."
}