Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Destination restrictions on outbound requests can be bypassed, which could allow the server to retrieve content from unintended resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:31.070Z",
  "pubdate": "2026-11-07T05:18:31.070Z",
  "executiveSummary": "IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows a remote authenticated attacker to bypass established destination restrictions governing outbound requests initiated by the server. By manipulating request parameters, an attacker can force the application to perform unauthorized requests to unintended internal or external resources. The primary impact involves the exposure of sensitive information that would otherwise be protected by network segmentation or access control lists. The vulnerability necessitates that the attacker possesses authenticated access to the platform to initiate the exploit. Given the nature of API Connect as a gateway, this vulnerability presents significant risk, as it potentially grants an attacker the ability to probe internal service meshes, retrieve metadata from cloud environments, or access restricted internal management interfaces that the gateway is permitted to reach, effectively turning the gateway into a proxy for malicious reconnaissance and data exfiltration.",
  "technicalDetails": "The vulnerability resides within the request processing logic of IBM API Connect, where outbound request mechanisms fail to sufficiently validate or constrain the target destination of server-initiated HTTP requests. The root cause is an improper implementation of egress filtering or destination allow-listing that can be circumvented by an authenticated attacker.\nExploitation occurs when an attacker submits specially crafted API requests that interact with the vulnerable component's outbound communication features. By injecting malicious URLs or manipulating routing headers, the attacker bypasses the internal security logic intended to restrict the server from interacting with unauthorized endpoints. Because the requests originate from the API Connect server itself, the traffic often appears to be originating from a trusted internal source, effectively bypassing traditional perimeter firewalls and local network security groups.\nThe attack flow proceeds as follows: First, the authenticated attacker identifies a feature or endpoint within API Connect that performs server-side requests, such as proxying, webhooks, or dynamic backend routing. Second, the attacker manipulates the inputs associated with these requests to target unauthorized destinations, including local loopback addresses (127.0.0.1), internal service IP addresses, or sensitive metadata services (e.g., AWS/Azure IMDS). Third, the vulnerable component processes the request without enforcing the intended destination restrictions. Fourth, the server executes the outbound request to the target resource and returns the response payload back to the attacker, resulting in unauthorized information disclosure.\nThis SSRF vector is particularly dangerous within the context of IBM API Connect, as the platform is often granted high-privilege access to sensitive backend services and administrative APIs. Successful exploitation allows for the discovery of internal network topology, the extraction of service tokens, or interaction with private APIs that lack secondary authentication layers. Because the vulnerability allows for arbitrary outbound requests, it may also be leveraged for port scanning of the underlying infrastructure or facilitating further attacks against internal systems that trust the API gateway's IP address. The vulnerability remains effective for all identified versions between 12.1.0.0 and 12.1.1.2 inclusive, requiring administrative oversight to monitor egress traffic patterns."
}