IBM API Connect 12.1.0.0 through 12.1.1.2 contains a server‑side request forgery flaw that allows a remote attacker to supply arbitrary URLs, causing the server to fetch data from unintended destinations and return the response to the attacker. This results in the disclosure of sensitive information that may otherwise be protected by the server’s outbound request restrictions. The weakness is identified as CWE‑918, a classic SSRF vulnerability with the potential for data exfiltration.

All instances of IBM API Connect version 12.1.0.0 up to and including 12.1.1.2 are affected. No later versions are listed as vulnerable, and the vendor recommends upgrading to 12.1.1.3 to remove the flaw.

The vulnerability carries a CVSS score of 9.3, indicating a high severity level. Exploitation requires a remote attacker to supply a crafted request, after which the server performs a request to an arbitrary URL and returns the response. No EPSS data is available, and the vulnerability has not been listed in the CISA KEV catalog yet, but the combination of high severity and the ability to access internal resources makes it a critical risk in environments where API Connect services are exposed to untrusted networks.