IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server‑side request forgery flaw that allows a remote attacker who has authenticated to the API Connect service to send arbitrary HTTP requests from the server to internal or external resources, enabling the attacker to retrieve sensitive data such as internal service endpoints, configuration details, or logs that would otherwise be inaccessible. The damage is limited to the privileges of the authenticated account but could expose system‑wide secrets or private networks if the attacker directs requests to critical internal services.

Affected systems include IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

The CVSS score of 8.5 indicates a high severity vulnerability. EPSS is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation yet. The attack vector is remote authenticated; an attacker must first gain valid credentials to the API Connect instance. Once authenticated, the SSRF can be triggered by crafted requests, allowing the attacker to read internal network resources, with the potential to disclose confidential data and internal services exposed via the API Connect instance.