Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:35.407Z",
  "pubdate": "2026-11-07T05:18:35.407Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe vulnerability enables a remote authenticated attacker to induce the application to make unauthorized requests to internal or external resources.\nSuccessful exploitation may lead to the disclosure of sensitive information by leveraging the server's identity to interact with restricted backend systems.\nThis flaw resides within the product's request processing logic, potentially allowing an attacker to bypass network access controls.\nExploitation requires the attacker to be authenticated to the platform, after which they can manipulate request parameters to target unintended endpoints.\nThe risk implication is significant as it facilitates unauthorized data access and reconnaissance within the internal network infrastructure.",
  "technicalDetails": "The vulnerability is a Server-Side Request Forgery (SSRF) flaw in IBM API Connect. It occurs because the application fails to adequately validate or restrict user-supplied input used in server-side request mechanisms.\nWhen a request is submitted to vulnerable components, the application processes the input without enforcing strict allow-lists for target destinations. This permits an authenticated attacker to craft malicious requests that the server subsequently executes against arbitrary URIs.\nThe attack flow involves an authenticated user interacting with specific API endpoints or management interfaces that perform backend requests to remote services. By injecting a target URL into vulnerable request parameters, the attacker forces the IBM API Connect server to initiate a secondary HTTP/HTTPS request.\nBecause the server initiates these requests, the traffic appears to originate from the API Connect instance itself, bypassing network-level ingress filters or firewall rules that protect internal services from external access. The server acts as a proxy, reflecting responses back to the attacker or enabling the attacker to perform port scanning and service discovery on the internal network segment.\nAffected versions include IBM API Connect 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2. The vulnerability exists because the underlying logic does not implement sufficient sanitization for outbound request URIs. In scenarios involving microservices or backend administrative interfaces, this can lead to the exfiltration of metadata, configuration files, or sensitive internal data protected by local network boundaries.\nPost-exploitation, an attacker can pivot within the infrastructure, interacting with internal APIs or metadata services that are not intended to be reachable by external users. The impact is primarily the loss of confidentiality regarding internal assets and the potential for further unauthorized interaction with backend services that trust the origin of the API Connect platform.\nAuthentication is a prerequisite for this exploit, meaning the threat actor must possess valid credentials to access the vulnerable functionality before they can trigger the SSRF condition."
}