Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-11-07T05:18:37.140Z",
  "pubdate": "2026-11-07T05:18:37.140Z",
  "executiveSummary": "This vulnerability is identified as a Server-Side Request Forgery (SSRF) flaw affecting specific versions of IBM API Connect.\nThe issue permits a remote, authenticated attacker to induce the application to make unauthorized requests to internal or external resources.\nThe vulnerability affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe primary impact involves the potential disclosure of sensitive information, as an attacker can leverage the server as a proxy to interact with restricted network services, internal metadata APIs, or backend infrastructure that is otherwise inaccessible from the public internet.\nSuccessful exploitation requires the attacker to have valid authentication credentials within the target environment.\nThis flaw poses a significant risk to organizational infrastructure, as it may allow an attacker to bypass perimeter security controls, scan internal network segments, or exfiltrate data from private services residing within the trust boundary of the affected API Connect deployment.",
  "technicalDetails": "The vulnerability is categorized as a Server-Side Request Forgery (SSRF), which occurs when a web application fails to adequately sanitize or validate user-supplied input used to construct network requests.\nIn the context of IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2, the application components responsible for processing API definitions or external configurations likely do not implement sufficient allow-listing or URI validation logic.\nThe attack flow begins with a remote authenticated attacker submitting a crafted request containing a malicious URI to an endpoint handled by the vulnerable component. By injecting internal network addresses (such as 127.0.0.1, internal service IP addresses, or link-local addresses), the attacker forces the IBM API Connect server to initiate an outbound request to the target destination using its own credentials or network identity.\nBecause the server executes the request, it may bypass host-based firewalls, access control lists (ACLs), or network segment isolation that would typically protect internal services. If the target service interprets the request as originating from a trusted internal source, it may respond with sensitive data, configuration details, or administrative interfaces.\nThe scope of post-exploitation activity depends heavily on the internal network topology. If the server has permissions to query cloud provider metadata services (e.g., AWS IMDS, Azure Instance Metadata Service), the attacker could potentially exfiltrate instance identity tokens, temporary security credentials, or environment-specific configuration secrets.\nThe vulnerability is limited by the requirement for authentication; however, once an attacker has established a session, they can perform reconnaissance on the internal network, interact with internal APIs that lack strong authentication, or pivot to other systems within the private network segment. The lack of strict protocol enforcement during these forged requests may also allow an attacker to interact with non-HTTP services if the underlying library or function implementation supports protocols such as gopher, dict, or file, depending on the server configuration.\nThe root cause lies in the application's failure to restrict the destinations of server-initiated network requests to a verified set of trusted endpoints. Without robust URI parsing and strict validation of hostnames and ports, the application remains susceptible to requests that target unauthorized internal infrastructure."
}