IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw that allows a remote authenticated attacker to instruct the server to request and retrieve data from external resources that should not be accessed. The vulnerability is identified as CWE-918 and can result in the exposure of confidential data intended to remain within the internal environment. The flaw arises when service definitions are imported and references to external resources are not sufficiently validated or restricted, enabling the attacker to coerce the server into accessing arbitrary external URLs.

The affected products are IBM API Connect, with versions ranging from 12.1.0.0 up to and including 12.1.1.2. Any installation of these versions deployed in an environment where users have the ability to import service definitions is potentially vulnerable.

The CVSS score of 8.5 indicates a high severity, and while the EPSS score is not available, the risk remains significant because the vulnerability requires an authenticated user with permission to import service definitions. The vulnerability is not listed in the CISA KEV catalog, but its potential to leak sensitive data makes mitigation a priority. An attacker would need to upload a crafted service definition that references a malicious or sensitive external resource; the server would then reach out and retrieve that data, which could be non-rectifiable if it contains confidential information.