Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:48.390Z",
  "pubdate": "2026-11-07T05:18:48.390Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw permits a remote, authenticated attacker to manipulate the server into executing unauthorized requests to internal or external resources.\nThe vulnerability arises from improper validation of user-supplied input used in request generation processes. By successfully exploiting this, an attacker can bypass security controls to interact with internal services that are otherwise inaccessible from the public network, potentially leading to unauthorized information disclosure.\nThe impact is significant, as it grants attackers the ability to map internal network topology, extract sensitive metadata, or retrieve internal API responses. Exploitation requires the attacker to possess authenticated access to the IBM API Connect environment, limiting the attack surface to authorized users or those who have compromised valid credentials.\nOrganizations using the specified versions are advised to restrict internal network exposure and apply necessary updates to address this security flaw.",
  "technicalDetails": "The vulnerability is a Server-Side Request Forgery (SSRF) identified within the IBM API Connect ecosystem. The root cause is categorized as an improper input validation flaw where the application fails to adequately sanitize or restrict the destination URLs or resource identifiers passed to internal request-handling mechanisms.\nIn terms of attack flow, the exploitation process begins with an authenticated attacker interacting with the IBM API Connect interface. The attacker injects a malicious payload into specific input fields that the application subsequently uses to initiate backend HTTP or other protocol-based requests. Because the application server performs these requests on behalf of the attacker, it acts as a proxy, bypassing firewalls and network segmentation policies that usually protect the internal infrastructure.\nBy manipulating these requests, an attacker can induce the IBM API Connect server to perform GET or other method requests against internal endpoints, such as metadata services (e.g., cloud environment instance metadata), internal management consoles, or private APIs that do not require secondary authentication. This effectively leverages the server's identity and network position to reach sensitive assets.\nThe vulnerability affects IBM API Connect versions 12.1.0.0 through 12.1.1.2. The exploitation is restricted to remote, authenticated attackers, meaning the adversary must first establish a valid session within the application. Once authenticated, the attacker does not necessarily require elevated privileges to trigger the SSRF, provided they have access to the vulnerable function or endpoint that executes the request.\nPost-exploitation impact includes the potential for information disclosure, where the attacker captures the response bodies from the forged requests. This may reveal proprietary API documentation, internal service configurations, or environment variables. Furthermore, the SSRF may facilitate reconnaissance for deeper lateral movement or allow the attacker to scan internal network segments for additional vulnerable services. The lack of stringent egress filtering on the host machine increases the severity, as it allows the server to reach arbitrary destinations on the network that the attacker would not normally be able to probe directly."
}