Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:46.690Z",
  "pubdate": "2026-11-07T05:18:46.690Z",
  "executiveSummary": "IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows a remote authenticated attacker to manipulate the server into initiating unauthorized requests to internal or external resources.\nThe vulnerability resides in the application's handling of user-supplied input used in request generation. By exploiting this, an attacker can bypass network security controls, gain access to sensitive internal services, or interact with restricted infrastructure that is not normally exposed to the internet.\nSuccessful exploitation requires the attacker to hold valid authentication credentials within the target environment. The impact of this vulnerability includes potential information disclosure, unauthorized access to backend services, and interaction with internal APIs or metadata services.\nIBM API Connect users are advised to review the vulnerability impact and apply necessary updates or configuration changes as officially recommended by IBM to secure the platform against unauthorized server-side request execution.",
  "technicalDetails": "The vulnerability is identified as a Server-Side Request Forgery (SSRF) flaw occurring within IBM API Connect versions 12.1.0.0 through 12.1.1.2. The root cause lies in improper validation and sanitization of user-supplied input that governs the destination parameters of outbound requests initiated by the server-side application component.\nIn a standard attack flow, an authenticated attacker crafts a malicious request targeting an internal endpoint managed by the API Connect instance. The application, failing to enforce strict allow-lists or schema validation on the request's destination, proceeds to execute the request on behalf of the attacker. This allows the server to act as a proxy or agent to interact with unauthorized resources.\nBecause the requests originate from the server itself, the traffic bypasses perimeter-based security measures such as firewalls or network access control lists (ACLs) that would typically protect internal services. An attacker can leverage this capability to perform port scanning on internal infrastructure, interact with internal REST APIs, or access cloud-native metadata services (e.g., IMDS on AWS/Azure) to exfiltrate sensitive configuration data or temporary security credentials.\nExploitation is predicated on the attacker possessing authenticated access to the system. Once authenticated, the attacker influences the logic of the vulnerable component—specifically those functions responsible for remote resource interaction—to send requests to arbitrary IP addresses or hostnames. The payload does not necessarily require complex injection but rather the clever manipulation of target URLs or headers to trigger the desired server-side request.\nThe post-exploitation impact is significant, as it grants the attacker a foothold within the trusted network zone. By masquerading as the API Connect server, the attacker can extract data from internal database interfaces, admin dashboards, or microservices that trust the local network environment implicitly. The vulnerability persists across all noted versions (12.1.0.0 to 12.1.1.2) until proper input validation controls are implemented to verify the integrity and destination of all server-initiated outbound traffic."
}