Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:36.743Z",
  "pubdate": "2026-11-07T05:18:36.743Z",
  "executiveSummary": "This vulnerability is a Server-Side Request Forgery (SSRF) flaw affecting IBM API Connect, specifically versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe security flaw allows a remote authenticated attacker to influence the server into making unauthorized requests to unintended locations.\nThe primary risk associated with this vulnerability is the potential for unauthorized information disclosure, as the server may be leveraged to interact with internal resources, services, or metadata endpoints that are otherwise restricted from the public network.\nExploitation requires the attacker to possess valid authentication credentials within the target system.\nSuccessful exploitation compromises the confidentiality of internal network structures and sensitive data accessible to the API Connect instance.\nOrganizations utilizing the specified versions of IBM API Connect are advised to assess their exposure and monitor for anomalous outbound requests originating from the API management infrastructure.",
  "technicalDetails": "The vulnerability resides within the request handling logic of IBM API Connect, where insufficient validation of user-supplied input allows for the manipulation of outgoing server-side requests.\nServer-Side Request Forgery (SSRF) occurs when an application fetches a remote resource without appropriately validating the target URI, enabling an attacker to force the application to perform requests on their behalf.\nIn this context, an authenticated attacker can submit crafted input to specific API endpoints, tricking the server into initiating requests to arbitrary destinations, including internal-only services, cloud metadata services (e.g., 169.254.169.254), or other network-restricted systems.\nThe exploitation flow begins with the attacker identifying an endpoint that processes external parameters to fetch data or interact with backend services. By injecting a malicious URI, the attacker overrides the intended target.\nSince the request originates from the IBM API Connect server, it often bypasses perimeter firewalls and network segmentation controls, effectively granting the attacker the identity and network access permissions of the server itself.\nThe post-exploitation impact includes the ability to perform reconnaissance on internal network topologies, execute port scanning against internal infrastructure, and exfiltrate sensitive configuration data or credentials stored within internal environment variables or metadata stores.\nThe vulnerability is limited to authenticated actors, implying that the attack surface is exposed to legitimate users or compromised accounts within the API Connect ecosystem.\nThe flaw manifests because the application fails to enforce an allow-list or perform rigorous protocol and host validation before performing the backend request.\nAffected software versions include IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The lack of proper request sanitization leads to an escalation of trust where the server acts as an unauthorized proxy for the authenticated user."
}