Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:48.900Z",
  "pubdate": "2026-11-07T05:18:48.900Z",
  "executiveSummary": "A server-side request forgery (SSRF) vulnerability has been identified in IBM API Connect, affecting versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe vulnerability enables a remote authenticated attacker to induce the application to make unauthorized requests to arbitrary internal or external resources.\nThis flaw exposes sensitive information by allowing attackers to interact with backend services or internal infrastructure that are otherwise inaccessible from the public network.\nSuccessful exploitation requires the attacker to possess authenticated access to the system.\nThe risk implication is significant, as it permits lateral movement within the network, potential information disclosure of sensitive configuration data, and unauthorized interaction with internal APIs.\nOrganizations using the specified versions of IBM API Connect are at risk of data leakage and infrastructure compromise if an attacker gains valid credentials and leverages this SSRF entry point.",
  "technicalDetails": "The vulnerability resides within the request handling mechanism of IBM API Connect, where insufficient validation of user-supplied input allows for the manipulation of internal service requests.\nAn SSRF occurs when the application server is coerced into executing HTTP or other protocol-based requests on behalf of the attacker.\nThe attack flow begins with the authenticated user submitting a request containing a malicious payload designed to target a specific internal or external URL.\nBecause the server lacks adequate filtering or allow-listing of destination endpoints, the application processes the request, directing the internal request engine to retrieve content from the attacker-specified resource.\nThis behavior bypasses standard network perimeter controls such as firewalls or network access control lists (ACLs) that would normally restrict direct access to the internal environment.\nUpon receiving the request, the target infrastructure treats the IBM API Connect server as a trusted origin, potentially disclosing sensitive metadata, internal application headers, or backend database contents.\nThe exploitation process typically involves the attacker probing the local loopback interface (127.0.0.1) or internal network segments to identify reachable services, such as internal management interfaces, administrative APIs, or cloud metadata services (e.g., AWS IMDS).\nPost-exploitation impact involves the exfiltration of credentials, API keys, or proprietary configuration files that reside within the trusted internal network space.\nThe technical root cause is an improper input validation vulnerability where the application fails to enforce strict service-side security policies regarding permitted URL schemes, hostnames, and IP ranges before initiating an outbound connection.\nAs this vulnerability requires authentication, the attack surface is limited to users or entities possessing valid credentials, yet it significantly increases the impact of a compromised account by granting the attacker a foothold into the internal architecture."
}