Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network services due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-11-07T05:18:47.637Z",
  "pubdate": "2026-11-07T05:18:47.637Z",
  "executiveSummary": "This vulnerability is a Server-Side Request Forgery (SSRF) flaw identified in IBM API Connect. The issue resides within the internal request handling mechanisms of the application, allowing an attacker to manipulate the system into initiating arbitrary outbound requests toward internal network services.\nThe vulnerability affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The security impact is significant, as successful exploitation enables an authenticated remote attacker to bypass network segmentation and interact with backend components that are not intended to be exposed to the public internet or the client-facing API gateway.\nBy leveraging this SSRF, an attacker can conduct unauthorized reconnaissance, probe internal endpoints, or potentially interact with sensitive services residing within the local network infrastructure. The exploitation requires the attacker to have valid authentication, implying that the attack surface is limited to users with existing access to the platform. Organizations should prioritize patching to the latest available versions to neutralize the risk of unauthorized lateral movement and information disclosure facilitated by these forged requests.",
  "technicalDetails": "The vulnerability is characterized as a Server-Side Request Forgery (SSRF) occurring within the IBM API Connect gateway architecture. At its core, the flaw stems from insufficient validation of user-supplied input used to construct downstream HTTP requests. When the gateway component processes certain API calls, it fails to adequately sanitize or restrict the destination host, protocol, or port for requests initiated by the server on behalf of the client.\nThe attack flow initiates when an authenticated remote attacker sends a specifically crafted request to the API Connect endpoint. By injecting malicious parameters into fields that are subsequently processed by the server-side request execution engine, the attacker can force the application to send requests to arbitrary internal network resources. Because the server itself initiates the request, the traffic appears to originate from a trusted internal entity, effectively bypassing perimeter security controls such as firewalls or network access control lists (ACLs) that would otherwise protect backend infrastructure.\nVulnerable versions include IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The lack of strict allow-listing for outbound request destinations allows the attacker to specify internal IP addresses, local network service endpoints, or even loopback addresses (127.0.0.1) as the target destination. This allows the attacker to probe the internal environment for services that lack authentication or are vulnerable to other exploits, effectively using the API gateway as a proxy for internal network exploitation.\nPost-exploitation, the attacker can gain insight into the internal topology of the network. This includes the ability to perform port scanning, fingerprint internal software versions, and potentially retrieve sensitive information from administrative interfaces or internal-only APIs. The impact is exacerbated by the fact that internal services often operate with lower security constraints, assuming they are shielded by the primary network perimeter. The absence of robust URI validation and server-side request interception at the gateway level is the primary driver of this security failure. Unless the underlying HTTP client library used by the gateway is configured to explicitly deny requests to RFC 1918 addresses or restricted internal subnets, the vulnerability remains trivial to execute for any authenticated user with access to the affected request paths."
}