Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:52.683Z",
  "pubdate": "2026-11-07T05:18:52.683Z",
  "executiveSummary": "This vulnerability is identified as a Server-Side Request Forgery (SSRF) flaw within IBM API Connect.\nThe vulnerability enables a remote authenticated attacker to send arbitrary requests from the server to unintended internal or external resources.\nAffected products include IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe primary risk involves the unauthorized disclosure of sensitive information, potentially allowing the attacker to bypass internal network firewalls or access metadata services and backend infrastructure that are not intended to be publicly exposed.\nSuccessful exploitation requires the attacker to have authenticated access to the API Connect environment.\nBy manipulating requests handled by the vulnerable component, an attacker can influence the server to interact with arbitrary endpoints, thereby facilitating reconnaissance or data exfiltration from the internal network perimeter.",
  "technicalDetails": "The vulnerability resides in the request handling logic of IBM API Connect, where the application fails to adequately validate or restrict user-supplied input used in server-side request construction.\nThis flaw characterizes a typical SSRF vulnerability, where the application acts as a proxy for the attacker, executing requests on behalf of the user to unauthorized destinations.\nThe affected versions include IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe attack flow initiates when an authenticated user provides malicious input to a vulnerable endpoint or configuration parameter that triggers a backend network request.\nBecause the server-side process does not perform sufficient allow-listing or URI sanitization, an attacker can manipulate the target destination to point to internal services, such as local management interfaces, internal database clusters, or cloud-native metadata services (e.g., 169.254.169.254).\nOnce the request is initiated, the application executes the connection using its own privileges and network context.\nThe response from the requested internal resource is then potentially returned or reflected back to the attacker, leading to the leakage of sensitive internal data, configuration details, or service information.\nThis behavior is particularly critical in environments where the API Connect instance is positioned behind a perimeter firewall but has trusted connectivity to backend internal microservices.\nBy leveraging this SSRF capability, an attacker can bypass traditional IP-based access control lists (ACLs) because the request originates from a trusted internal source.\nPost-exploitation, the attacker can leverage the ability to perform HTTP requests to perform internal service discovery, mapping of internal network segments, or the exploitation of other vulnerabilities in non-public internal services that were previously shielded from direct external access.\nThe vulnerability effectively breaks the trust boundary between the API gateway and the internal network, allowing authenticated attackers to interact with internal resources that should remain isolated from API-level operations."
}