Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-11-07T05:18:37.510Z",
  "pubdate": "2026-11-07T05:18:37.510Z",
  "executiveSummary": "This vulnerability is classified as a Server-Side Request Forgery (SSRF) flaw affecting specific versions of IBM API Connect.\nThe vulnerability resides in the core request handling architecture, allowing a remote authenticated attacker to coerce the server into initiating unauthorized network requests to internal or external resources.\nAffected product lines include IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe primary risk implication involves the unauthorized retrieval of sensitive information by bypassing network access controls or internal service protections.\nExploitation requires the attacker to hold valid authentication credentials within the environment.\nThe successful execution of this vulnerability allows the attacker to leverage the server as a proxy to interact with systems unreachable from the public internet, potentially leading to information disclosure, unauthorized service interaction, or internal reconnaissance.",
  "technicalDetails": "The vulnerability manifests as a Server-Side Request Forgery (SSRF) within IBM API Connect, where the application fails to adequately sanitize or restrict user-supplied input used in server-initiated requests.\nWhen an attacker provides a crafted input containing an arbitrary URI, the application’s backend infrastructure processes this request without sufficient validation of the destination host or protocol, enabling the attacker to forge requests on behalf of the API Connect server.\nThe attack flow initiates with the attacker authenticating to the vulnerable API Connect instance. Once access is established, the attacker identifies an endpoint or interface that performs outbound resource retrieval based on user input. By injecting a malicious URI, the attacker forces the server to execute an outbound request targeting internal infrastructure (e.g., local services, metadata endpoints, or internal management interfaces) or external systems.\nBecause the server initiates these requests, the traffic often originates from a trusted internal source, allowing the attacker to bypass firewall rules and Network Access Control Lists (ACLs) that would otherwise block direct access to internal assets.\nThis behavior can lead to the exposure of sensitive configuration data, internal API tokens, or other proprietary information that is typically inaccessible to unauthorized remote parties.\nThe vulnerability affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The root cause lies in improper handling of network request parameters, which lack restrictive allow-lists for destination URLs or protocols.\nPost-exploitation, the impact is significant; an attacker may use the server as a pivot point for further internal scanning, port identification of protected internal services, or the extraction of environment-specific credentials.\nThe vulnerability is restricted to authenticated users, meaning the scope of exploitation is limited to those who have already bypassed the initial perimeter authentication controls. However, the integrity of the internal network architecture is compromised once the attacker is able to manipulate the server to interact with sensitive back-end components."
}