IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server‑side request forgery flaw that lets a remote attacker with valid credentials make the system perform HTTP requests on their behalf. The attacker can then capture responses from internal or external services, potentially exposing sensitive data. This flaw is classified as CWE‑918, indicating that the application fails to validate or restrict user‑supplied request URLs.

The vulnerability affects IBM API Connect deployments running version 12.1.0.0 up to 12.1.1.2. The vulnerable code exists in the API gateway component, which is exposed to external traffic. If your environment uses any of these releases, it is within the risk scope.

The reported CVSS score of 8.5 flags it as high impact. The EPSS score is not available, but the lack of KEV listing does not diminish the need for action. A remote authenticated attacker can exploit the flaw by sending specially crafted requests to the API gateway. Since the server makes the outbound request, the attacker can access resources that the API Connect server is permitted to reach, leading to information disclosure. The attack vector is inferred to be remote with authentication, based on the description.