Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
Published: 2026-11-07
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: Information Disclosure via SSRF
Action: Immediate Patch
AI Analysis

Impact

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server‑side request forgery flaw that allows an authenticated attacker to instruct the server to retrieve arbitrary content from internal resources. The vulnerability can expose sensitive data that should only be accessible by authorized internal services, potentially leading to leakage of confidential information.

Affected Systems

The affected products are IBM API Connect 10.0.8.x (from 10.0.8.0 to 10.0.8.12) and IBM API Connect 12.1.x (from 12.1.0.0 to 12.1.1.2). These versions are listed under their known CPE identifiers.

Risk and Exploitability

The flaw has a CVSS score of 8.5, indicating high severity, and it is not listed in the CISA KEV catalog. EPSS data is not available, so the current likelihood of exploitation cannot be quantified. The attack requires authentication but does not provide remote code execution; however, the ability to read internal data makes it a critical risk for organizations that rely on API Connect for secure access to backend services.

Generated by OpenCVE AI on November 7, 2026 at 07:56 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205 IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all

OpenCVE Recommended Actions

  • Update IBM API Connect to v12.1.1.3 or to v10.0.8.13 as recommended by IBM.
  • Validate and restrict the URLs that can be requested by the API Connect service, using an allow‑list of trusted domains to prevent abuse of the SSRF vector.
  • Configure network controls so that the API Connect server can only reach explicitly authorized external endpoints, thereby limiting the potential impact of any SSRF exploitation.

Generated by OpenCVE AI on November 7, 2026 at 07:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-918
CPEs cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:34:11.530Z

Reserved: 2026-07-25T04:19:17.509Z

Link: CVE-2026-17385

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:52.683

Modified: 2026-11-07T05:18:52.823

Link: CVE-2026-17385

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T08:30:14Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)