Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:43.460Z",
  "pubdate": "2026-11-07T05:18:43.460Z",
  "executiveSummary": "IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows a remote, authenticated attacker to manipulate the server into making unintended requests to internal or external resources.\nThe vulnerability originates from improper handling of user-supplied input during request processing, which can be leveraged to bypass network segmentation or access restricted internal services that are otherwise unreachable from the public internet.\nThe primary risk implications include unauthorized access to metadata services, internal APIs, or backend administrative interfaces. Successful exploitation requires the attacker to be authenticated within the environment, limiting the threat vector to malicious insiders or compromised user accounts.\nOrganizations using the affected versions of IBM API Connect are at risk of sensitive data exposure and potential escalation of impact within their service architecture. The vulnerability facilitates reconnaissance and interaction with the backend infrastructure, posing a significant risk to the confidentiality and integrity of the internal network.",
  "technicalDetails": "The vulnerability is a Server-Side Request Forgery (SSRF) flaw residing within the request handling logic of IBM API Connect versions 12.1.0.0 through 12.1.1.2. The root cause lies in the application's failure to adequately validate or restrict URLs provided by users when the server initiates downstream requests.\nAn attacker with valid authentication credentials can supply maliciously crafted input to the affected API endpoints. By manipulating these parameters, the attacker forces the IBM API Connect server to perform HTTP requests to arbitrary destinations. Because these requests originate from the server itself, they may bypass firewall rules or other perimeter security controls that would normally block direct external traffic to internal resources.\nThe attack flow proceeds as follows: First, the authenticated attacker identifies an endpoint in the API Connect management or gateway interface that facilitates outbound communication or URL redirection. Second, the attacker submits a request containing an attacker-controlled URL or a crafted redirect payload targeting internal infrastructure, such as localhost, private IP addresses (e.g., 169.254.169.254 for cloud metadata), or restricted backend services.\nThe server processes this input without sufficient sanitization or destination allow-listing. Consequently, the server initiates an outbound connection to the target URI. If the target service responds, the resulting information—which may include internal configuration details, service tokens, or sensitive data payloads—may be reflected back to the attacker or stored in a way that allows for subsequent retrieval.\nThe technical impact is significant as it transforms the API Connect server into a proxy for the attacker. Beyond simple information disclosure, this capability can be leveraged to conduct port scanning of internal networks, interact with internal APIs that lack strong authentication, or extract sensitive environment metadata. The exploitation does not inherently require administrative privileges, though the level of post-exploitation access is contingent on the permissions assigned to the service account executing the API Connect processes. The vulnerability persists until appropriate input validation logic or request filtering mechanisms are implemented to restrict outbound traffic to trusted domains and endpoints only."
}