Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of external references. When schemas are validated, references to external resources are not sufficiently restricted, which could allow the server to retrieve content it should not access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:34.963Z",
  "pubdate": "2026-11-07T05:18:34.963Z",
  "executiveSummary": "This vulnerability involves improper validation of external references during schema processing within IBM API Connect, which effectively constitutes an XML External Entity (XXE) or similar resource injection flaw. The vulnerability allows a remote authenticated attacker to coerce the server into fetching external resources that should otherwise be restricted.\nAffected products include IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The security implications are significant, as successful exploitation enables an attacker to perform Server-Side Request Forgery (SSRF) or gain unauthorized access to sensitive local or remote content.\nBy manipulating schema definitions, an attacker can force the backend service to retrieve data from internal network locations, sensitive files, or restricted API endpoints. This vulnerability requires the attacker to have authenticated access to the system. The risk is elevated in environments where IBM API Connect has access to internal metadata or configuration services, as the server acts as a proxy for the attacker's requests, bypassing standard network perimeter controls.",
  "technicalDetails": "The vulnerability resides within the schema validation engine of IBM API Connect. The root cause is a failure to properly sanitize or constrain URI resolution when the system processes external references defined within input schemas. When the system parses a schema, it attempts to resolve defined references; if the underlying parser is not configured to disable the loading of external entities or resources, it will attempt to retrieve content based on the URI provided by the user.\nThe exploitation method involves an authenticated attacker crafting a malicious schema definition that includes specific external resource identifiers. These identifiers point to internal resources, file system paths, or external services that the server is permitted to access. When the API Connect instance processes the uploaded or submitted schema, the parser triggers an out-of-band request to the specified resource.\nThe attack flow proceeds as follows: First, the attacker identifies an API endpoint or management interface where schema inputs are processed. Second, the attacker submits a schema containing a reference directive (such as an external entity definition or a URI-based schema include) that targets an sensitive internal network location or sensitive file. Third, the IBM API Connect server, acting as the processor, attempts to resolve this reference and retrieves the external resource's content. Finally, the server includes or reflects the retrieved content back into the response or processes it in a way that allows the attacker to view or infer information about the targeted resource.\nThis vulnerability is particularly dangerous because the server performs the request, allowing the attacker to bypass firewall restrictions and reach internal components that are not exposed to the public Internet. The vulnerable component is the schema validation engine responsible for processing external schema references. Affected versions include 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2. The vulnerability requires authentication, meaning an attacker must already have access to an account capable of submitting or modifying API definitions or schema configurations. Post-exploitation, an attacker can extract sensitive configuration data, internal network topography details, or content from internal microservices, potentially facilitating lateral movement or further attacks on the internal infrastructure."
}