The vulnerability is a server‑side request forgery that permits an attacker who is authenticated to broker requests the API Connect server makes to external destinations. The server can be coerced into issuing proxy‑like requests and returning the results, enabling attackers to map network topology and harvest sensitive credentials such as internal service accounts and secrets. The impact is the disclosure of confidential data and potential subsequent lateral movement within the network.

IBM API Connect is affected for all releases from 10.0.8.0 through 10.0.8.12 and from 12.1.0.0 through 12.1.1.2. These versions allow a remote authenticated attacker to exploit the SSRF flaw.

The CVSS score of 6.8 classifies the risk as moderate, and the EPSS score is not available, indicating no publicly known exploitation data. The flaw is not listed in the CISA KEV catalog. Attacks are likely performed against the web interface of API Connect and require prior authentication, but once authenticated the attacker can send crafted requests to arbitrary internal or external resources to retrieve sensitive information.