IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper validation of user‑supplied URLs. A remote authenticated attacker can supply a crafted URL that the server will resolve and connect to, enabling the appliance to contact arbitrary internal network resources. This flaw, classified as CWE-918, is a server‑side request forgery that allows access to internal systems. The likely attack vector is a server‑side request forgery, inferred because the flaw permits the appliance to resolve arbitrary URLs and reach internal resources.

The vulnerability affects IBM’s API Connect product. Specifically, any installation of IBM API Connect 10.0.8.0 through 10.0.8.12 inclusive, as well as versions 12.1.0.0 through 12.1.1.2, is impacted. Users running these versions should assess their environment for this exposure.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The attacker requires authenticated access to API Connect; after authorization, they can trigger the flaw by supplying a malicious URL. Once exploited, the server can reach internal addresses or services that are not otherwise exposed. Based on the description, it is inferred that valid authentication is required to trigger the flaw.