A remote authenticated attacker can cause IBM API Connect to provoke outbound connections to Webhook destination URLs that are improperly validated. By submitting specially crafted URLs that point to internal network addresses, the server can be made to contact and potentially access internal systems, enabling probing or discovery of internal resources. The vulnerability is classified as CWE‑918 and delivers a moderate‑severity risk, providing an attacker with a means to influence internal network communications from an externally reachable interface.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected. These versions run on IBM's API Connect platform and are addressed by IBM's vendors. The CVE covers both the 10.x and 12.x release lines, indicating that environments deploying either line are vulnerable unless patched.

The CVSS score of 6.4 indicates a moderate impact, and the vulnerability requires an authenticated session to exploit. The EPSS score is not available, so the precise likelihood of exploitation is unknown; however, it is not listed in the CISA KEV catalog, suggesting no documented exploitation at this time. The attack vector relies on an attacker who has valid credentials to the API Connect administrative interface, but once authenticated the attacker can configure webhook URLs that traverse internal networks. This creates a risk of internal network reconnaissance and potential lateral movement if the target systems do not adequately guard against such outbound connections.