Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:42.900Z",
  "pubdate": "2026-11-07T05:18:42.900Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in IBM API Connect versions 12.1.0.0 through 12.1.1.2.\nThe vulnerability permits a remote authenticated attacker to induce the server to make unauthorized requests to internal or external resources.\nSuccessful exploitation allows the attacker to obtain sensitive information that is otherwise protected by the network perimeter.\nThe risk is categorized as high, as it grants attackers the ability to probe internal network services, bypass access controls, and potentially retrieve metadata or configuration data from the underlying infrastructure.\nExploitation requires the attacker to be authenticated, meaning the vulnerability is most dangerous in environments where untrusted users possess valid API Connect accounts or when account takeover occurs.\nThis flaw compromises the confidentiality of internal services and private network assets.",
  "technicalDetails": "The vulnerability resides in the way IBM API Connect processes requests that involve fetching external resources or communicating with backend services.\nThe root cause is an improper validation of user-supplied input used in the construction of outbound requests. When an attacker provides crafted input, the server fails to sufficiently sanitize or restrict the destination URL, allowing the server-side process to be manipulated.\nThe attack flow begins with the authenticated user submitting a request to a vulnerable component within the API Connect platform that triggers an outbound fetch. By manipulating the parameters that define the target URI, the attacker can redirect the server's HTTP client toward arbitrary targets.\nBecause the server originates these requests, it can bypass standard firewall rules and network ACLs that protect internal-only resources. For instance, the attacker can direct the server to interact with internal microservices, management interfaces, or metadata services (such as the cloud provider's Instance Metadata Service) which are typically not exposed to the public internet.\nThe vulnerability allows the attacker to leverage the server's identity to bypass authentication mechanisms enforced by internal systems that rely on network-level trust. This effectively elevates the attacker's privilege level to that of the API Connect service itself.\nThe impact includes the exposure of sensitive configuration files, environment variables, system information, or data from internal APIs that do not require secondary authentication when accessed from within the trusted network segment.\nThis SSRF vector specifically affects IBM API Connect versions 12.1.0.0 through 12.1.1.2. The lack of robust input filtering on the proxy logic is the primary technical failure, allowing an attacker to force the platform to perform unauthorized actions against local or remote network resources."
}