Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:34.100Z",
  "pubdate": "2026-11-07T05:18:34.100Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThis flaw permits a remote, authenticated attacker to induce the server to make unauthorized requests to internal resources or external services.\nThe vulnerability poses a significant risk to the confidentiality of internal network information and system infrastructure.\nBy leveraging this flaw, an attacker can bypass traditional network perimeter defenses, interacting with services or data repositories that are otherwise inaccessible from the public internet.\nSuccessful exploitation requires the attacker to hold valid authentication credentials for the target API Connect instance.\nThe primary risk involves the unauthorized disclosure of sensitive data, potential interaction with internal backend APIs, and the mapping of internal network topologies.",
  "technicalDetails": "The vulnerability resides within the request handling logic of IBM API Connect, where insufficient validation of user-supplied input allows the manipulation of backend request routing or destination parameters.\nSSRF occurs when an application processes a URL or network address provided by a user without proper sanitization, allowing the application to act as a proxy for malicious requests.\nIn the context of IBM API Connect, the vulnerable component processes requests that are subsequently forwarded to internal or external systems. An authenticated attacker can craft malicious input that forces the server to initiate an outbound request toward an arbitrary target.\nThe attack flow begins with the authenticated attacker identifying an endpoint that accepts input influencing subsequent server-side network requests. By injecting a crafted URI pointing to internal loopback addresses (e.g., 127.0.0.1), local services, or restricted internal network resources, the attacker circumvents access control mechanisms.\nBecause the server initiates these requests, the traffic appears to originate from a trusted internal source. This allows the attacker to reach restricted management consoles, metadata services (such as cloud instance metadata), or internal databases that lack secondary authentication layers.\nThe vulnerability affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The exploitation requires the attacker to be authenticated, meaning the attack surface is limited to users or entities with valid system access, though the resulting impact may include privilege escalation or the theft of administrative configuration data.\nThe post-exploitation impact includes the exfiltration of sensitive information, reconnaissance of internal network architecture, and potential interaction with internal APIs, enabling further lateral movement within the environment. Payload behavior typically involves manipulating HTTP headers or query parameters to redirect the server's request mechanism to unintended destinations."
}