Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-11-07T05:18:59.597Z",
  "pubdate": "2026-11-07T05:18:59.597Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in IBM API Connect, affecting versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThis vulnerability allows a remote, unauthenticated attacker to manipulate the affected component into executing arbitrary HTTP requests to unintended destinations.\nBy coercing the application to act as a proxy or intermediary, an attacker can interact with internal network services that are otherwise inaccessible from the public internet.\nThe primary risk involves the unauthorized disclosure of sensitive information, potential exploitation of internal APIs, and the discovery of internal network infrastructure.\nThe vulnerability stems from improper validation of user-supplied input used in server-side request mechanisms, granting the attacker the capability to leverage the trust associated with the vulnerable server's network location.",
  "technicalDetails": "The vulnerability resides within the request handling logic of IBM API Connect, where the application fails to adequately sanitize or restrict the destination parameters of outbound requests initiated by the server.\nThis SSRF vulnerability is triggered when the application accepts user-controlled input to define the target URI for a backend request without enforcing strict allow-listing or network segmentation policies.\nThe attack flow commences with the attacker sending a crafted request to the vulnerable IBM API Connect endpoint. The payload contains a URI pointing to an internal resource—such as a metadata service, internal configuration dashboard, or an otherwise unreachable backend management interface—rather than the intended external target.\nUpon receipt of the malicious request, the vulnerable component processes the URI and initiates an outbound connection from its own network interface. Because the request originates from the server itself, it bypasses network-level access control lists (ACLs) and firewall rules that would normally block external access to these internal endpoints.\nThe server subsequently receives the response from the targeted internal resource and, due to the flaw in the component's design, reflects the response content or specific metadata back to the attacker's original request context.\nThis behavior facilitates the exfiltration of sensitive information, such as configuration details, environment variables, or internal API responses that may contain authentication tokens or user data.\nIn terms of network exposure, this vulnerability is particularly severe as it effectively weaponizes the API Connect instance as a pivot point. The vulnerability does not necessarily require prior authentication or elevated privileges, provided the entry point into the API Connect infrastructure is accessible. The post-exploitation impact is limited only by the connectivity of the affected server to the internal network environment and the sensitivity of the services reachable via the SSRF primitive."
}