IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an SSRF flaw (CWE-918) that can be triggered by a remote authenticated attacker to cause the API Connect server to contact internal network resources and retrieve data it is not authorized to expose. Based on the description, it is inferred that the attacker must have valid credentials to log into the API Connect management console before exploiting the flaw. The consequence is potential leakage of sensitive internal information or facilitation of lateral movement, limited to the host where API Connect runs but capable of exposing protected internal services reachable from that server.

IBM API Connect product from IBM, specifically affected editions are 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

The CVSS score of 5.5 indicates moderate severity, and an EPSS score is not available, making it difficult to quantify the current exploitation probability. Explicitly, the vulnerability requires an attacker to first authenticate using valid credentials to the API Connect management console – this inference comes from the description stating a remote authenticated attacker can exploit the flaw. Once authenticated, the attacker can craft malicious requests that the server will silently forward to internal network destinations. Because authentication is required, strong authentication mitigates the risk, though internal data exposure remains a concern. KEV does not list this vulnerability.