Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. A service that can be reached without authentication could be made to send requests to unintended destinations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-11-07T05:18:46.317Z",
  "pubdate": "2026-11-07T05:18:46.317Z",
  "executiveSummary": "IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This security flaw originates from improper validation of user-supplied input during request handling, allowing a remote, unauthenticated attacker to coerce the server into initiating arbitrary outbound requests to unintended internal or external destinations.\nThe vulnerability poses a significant risk to the confidentiality and integrity of the internal network architecture. By leveraging the server as a proxy, an attacker can bypass perimeter security controls, such as firewalls or network access control lists (ACLs), to interact with internal services that are otherwise not reachable from the public internet. This capability could lead to the unauthorized retrieval of sensitive data, discovery of internal infrastructure, or the performance of unauthorized actions against backend systems.\nExploitation does not require prior authentication, lowering the barrier to entry for potential adversaries. Successful exploitation necessitates only the ability to reach the vulnerable service and provide the malformed input required to trigger the illicit request. Organizations utilizing the affected versions of IBM API Connect are advised to prioritize security assessments and apply relevant vendor updates to remediate this exposure.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the IBM API Connect server to adequately validate and sanitize URIs or destination endpoints before performing requests on behalf of a user. The affected component within the IBM API Connect stack processes incoming service requests that involve fetching external resources or communicating with backend microservices. Due to the lack of strict allow-listing or URI scheme validation, an attacker can manipulate the request parameters to redirect the server's HTTP client toward internal or external resources.\nThe attack flow begins when an unauthenticated remote attacker sends a specifically crafted request to the vulnerable endpoint. This request contains a parameter interpreted by the backend service as a target for a subsequent outgoing request. Because the server does not enforce adequate security boundaries between external user input and internal network requests, the server-side process executes a connection to the URI provided by the attacker.\nThe network exposure is extensive, as the server acts as an intermediary or 'confused deputy.' From the perspective of internal network services, the unauthorized traffic originates from the trusted IBM API Connect instance rather than the attacker's source IP address. This effectively bypasses network-level segmentation, enabling the attacker to perform port scanning of internal infrastructure, query internal metadata services (such as cloud provider instance identity endpoints), or access sensitive configuration files and administrative interfaces that rely on IP-based trust models.\nRegarding payload behavior, the attacker typically injects a target URL—such as 'http://127.0.0.1:8080' or an internal service URL—into the vulnerable parameter. The server-side code performs a 'GET' or 'POST' request to this destination and returns the response body or metadata to the attacker. If the backend service processes credentials or authorization headers, the SSRF may lead to an escalation of privileges if the server-side application automatically attaches these headers to the outbound requests it generates. The impact is primarily the leakage of sensitive data that would otherwise remain protected by the network perimeter, though in certain deployment architectures, this could be extended to perform remote command execution if internal administrative interfaces are accessible via the SSRF vector."
}