IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server‑side request forgery flaw that can be triggered by a remote authenticated attacker. The vulnerability allows the attacker to bypass destination restrictions on outbound requests, enabling the server to retrieve data from unintended resources. As a result, confidential internal data or privileged resources may be exposed to the attacker, compromising the confidentiality of the system.

IBM API Connect is affected by this flaw. In particular, installations running version 12.1.0.0 up to and including 12.1.1.2 are vulnerable. The recommendation from IBM is to upgrade to version 12.1.1.3 or later.

The CVSS score of 8.5 indicates a high severity. Although no EPSS score is available, the flaw requires authentication, limiting the attacker to users with valid credentials. The vulnerability is not listed in the CISA KEV catalog, but it remains exploitable as long as vulnerable versions remain in use. Attackers who have compromised legitimate credentials could use this flaw to exfiltrate data from internal services or other systems the API Connect instance can reach.