IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server‑side request forgery flaw that lets an attacker who can authenticate to the platform send requests to internal hosts, potentially exposing sensitive data and triggering a denial of service. The vulnerability is a classic Server‑Side Request Forgery, CWE‑918. Because the flaw requires authentication, only users with platform credentials are at risk, but the impact can reach system‑wide internal resources if those are contacted.

Affected products are IBM API Connect 12.1.0.0 and 12.1.1.2 through the listed CPEs. Users running any of those versions should verify their installation and check the IBM Fix Central link for remediation.

The CVSS base score of 6.4 indicates moderate overall risk, and the lack of an EPSS score suggests no public exploitation data yet. The flaw is not listed in the CISA KEV catalog, but because it requires valid credentials it still poses a significant threat to systems where users have elevated privileges. An attacker can leverage the authentication to reach internal services; therefore, the risk is elevated for environments that expose sensitive hosts through the API layer.