Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:35.620Z",
  "pubdate": "2026-11-07T05:18:35.620Z",
  "executiveSummary": "A server-side request forgery (SSRF) vulnerability has been identified in IBM API Connect, affecting versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThis flaw allows a remote, authenticated attacker to manipulate the server into making unauthorized requests to arbitrary destinations, including internal network resources that are otherwise unreachable from the public internet.\nThe primary impact of this vulnerability is the unauthorized disclosure of sensitive information, as the attacker can force the application to interact with internal services and return the responses.\nSuccessful exploitation requires the attacker to possess authenticated access to the API Connect platform. By leveraging the application's request processing logic, an attacker can bypass network segmentation or access internal REST APIs, configuration endpoints, or sensitive data stores.\nGiven the nature of SSRF, the risk implication involves a potential breach of internal network perimeter security, allowing for deeper reconnaissance and potential lateral movement within the environment hosting the API management infrastructure.",
  "technicalDetails": "The vulnerability resides in the request handling mechanism of IBM API Connect, where the application fails to adequately validate or sanitize user-supplied input before initiating outbound requests to external or internal resources.\nThe root cause is an improper implementation of request processing, allowing an authenticated user to specify or influence the destination URI of a server-side request. By manipulating input parameters, an attacker can coerce the API Connect server to perform HTTP requests directed at target infrastructure chosen by the attacker.\nIn a typical attack flow, the attacker submits a specially crafted request to an API Connect endpoint that is designed to fetch metadata, perform proxying, or retrieve external resources. Instead of limiting the request to authorized domains or services, the application's underlying library or service component processes the attacker-provided URL.\nThe application acts as a proxy, sending the request from the internal server environment to the attacker-defined target. Because the request originates from the API Connect server's identity, it may successfully bypass firewalls or access control lists that trust the server's IP address.\nIf the target internal resource does not require additional authentication or is protected solely by network-level controls, the server-side request may return sensitive data, such as internal configuration details, service-to-service credentials, or application-specific responses, directly to the attacker.\nThis SSRF vulnerability effectively turns the IBM API Connect platform into an internal network proxy, enabling the attacker to perform port scanning, fingerprinting of internal services, and data extraction from restricted environments.\nThe scope of impact is contingent upon the network configuration of the API Connect deployment; if the server has broad access to sensitive internal backend systems or metadata services (e.g., cloud environment instance metadata), the severity of the data exposure is significantly amplified.\nThe flaw affects specifically IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. Because it requires authentication, the attacker must first establish a valid session, though the privileges required for the specific endpoint triggering the request may be low, depending on the architecture."
}