Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform server-side request forgery and relay unauthorized email messages due to improper neutralization of user-supplied input.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-11-07T05:18:45.740Z",
  "pubdate": "2026-11-07T05:18:45.740Z",
  "executiveSummary": "IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability caused by the improper neutralization of user-supplied input.\nThis security flaw enables a remote, unauthenticated attacker to manipulate the application into sending unauthorized requests to arbitrary internal or external network destinations.\nBeyond the core SSRF functionality, the vulnerability allows for the relay of unauthorized email messages, potentially facilitating phishing campaigns, spam distribution, or internal service reconnaissance.\nThe risk implication is significant as it potentially exposes internal infrastructure that is not normally reachable from the public internet, bypassing traditional network perimeters.\nSuccessful exploitation requires the attacker to submit crafted input that the application processes without adequate validation, leading to unintended side effects through the server's network stack.\nOrganizations utilizing the affected versions should prioritize updates or apply relevant vendor-provided security configurations to mitigate the risk of unauthorized data access and network exploitation.",
  "technicalDetails": "The vulnerability originates from improper neutralization of user-supplied input within the API Connect framework. Specifically, the input handling logic fails to sanitize or validate parameters processed by the application's request-handling components.\nThe primary impact is a Server-Side Request Forgery (SSRF) condition. In a typical attack flow, the attacker identifies an API endpoint or management interface within IBM API Connect that performs server-side network requests based on user input. By injecting a target URL or malicious payload into these parameters, the attacker forces the server to act as a proxy or relay.\nBecause the server initiates the request on behalf of the attacker, the traffic originates from the internal server context. This allows the attacker to bypass network-level access control lists (ACLs) or firewalls that protect internal resources, such as internal REST APIs, administrative consoles, or metadata services that are not exposed to the public internet.\nFurthermore, the vulnerability specifically facilitates the relay of unauthorized email messages. The application's underlying mail configuration or interaction logic appears to be accessible via the same injection vector. By manipulating input parameters that influence email headers or destination addresses, an attacker can coerce the system into sending arbitrary emails, effectively using the IBM API Connect server as an open mail relay.\nThe exploitation process generally follows these steps: 1) The attacker maps the application to identify features that initiate external network or SMTP-based communication. 2) The attacker crafts a request containing an manipulated URI or malicious header injection designed to redirect internal request processing. 3) The application, failing to enforce strict allow-lists or input validation, executes the request against the targeted internal or external resource. 4) The server returns the result of the request or confirms the dispatch of the unauthorized email, providing the attacker with confirmation of the vulnerability.\nThis vulnerability affects IBM API Connect versions 12.1.0.0 through 12.1.1.2. The lack of robust input sanitization creates an environment where malicious payloads can manipulate service-level configurations. Post-exploitation impact ranges from information disclosure of sensitive internal data to the degradation of the environment's integrity via unauthorized communication relay."
}