IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a Server Side Request Forgery flaw that allows a remote attacker with valid authentication to cause the appliance to send requests to internal or external targets, potentially exposing sensitive data. The weakness is classified as CWE-918 and can be used to obtain information that the authenticated user does not normally have access to, compromising confidentiality. This vulnerability can be exploited through normal operations of the API platform, requiring only that the attacker authenticate with credentials that have been granted any level of access within the API Connect environment.

IBM API Connect 10.0.8.0 up to 10.0.8.12 and 12.1.0.0 up to 12.1.1.2. Users of these builds should review their deployment to determine whether they employ a version within the affected range and whether they have enabled API surface that could be leveraged for SSRF.

The CVSS score of 5.5 places the vulnerability in the Moderate severity range. EPSS is not available, so the probability of exploitation cannot be precisely quantified, yet the flaw is not listed in CISA’s KEV catalog, indicating no known widespread exploitation. However, because the attack requires a valid authentication token, attackers who compromise credentials or exploit phishing can leverage this flaw. The impact is limited to information disclosure rather than full remote code execution, but the ability to access internal resources poses a significant risk, especially if the API Connect server can reach privileged internal services.