Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. The address is not sufficiently restricted, which could allow the server to contact internal systems.
Published: 2026-11-07
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access to Internal Network Resources
Action: Immediate Patch
AI Analysis

Impact

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper URL validation flaw that allows a remote authenticated attacker to supply a crafted URL; the server will attempt to contact the specified address, potentially reaching internal network resources. This flaw is classified as CWE-918 and can lead to unauthorized data access or internal network reconnaissance by an attacker who has legitimate credentials on the system.

Affected Systems

Affected products are IBM API Connect 10.0.8.0 up to 10.0.8.12 and 12.1.0.0 up to 12.1.1.2. The flaw exists in all intermediate releases within those ranges.

Risk and Exploitability

The CVSS score of 6.4 indicates a moderate impact, and no EPSS score is available, so the known exploitation probability is not quantified. The vulnerability is not listed in CISA KEV, suggesting no current widespread exploits are documented. The attack requires authentication and hinges on the API Connect ability to resolve and connect to the supplied URL, making the vulnerability exploitable only when an authenticated user can manipulate the target URL.

Generated by OpenCVE AI on November 7, 2026 at 07:10 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205 IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all

OpenCVE Recommended Actions

  • Upgrade IBM API Connect to version 12.1.1.3 or 10.0.8.13 as recommended by IBM to remove the URL validation flaw.
  • If an immediate upgrade is not feasible, restrict the set of URLs that the service may contact by implementing an allowlist on the API gateway or by disabling the feature that sends outbound connections to arbitrary URLs.
  • After applying mitigation changes, enforce network segmentation or firewall rules to ensure that API Connect cannot reach internal network resources unless explicitly intended.

Generated by OpenCVE AI on November 7, 2026 at 07:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. The address is not sufficiently restricted, which could allow the server to contact internal systems.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-918
CPEs cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:32:54.881Z

Reserved: 2026-07-25T01:04:24.866Z

Link: CVE-2026-17303

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:38.293

Modified: 2026-11-07T05:18:38.430

Link: CVE-2026-17303

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T12:00:15Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)