The vulnerability is a server‑side request forgery that allows an attacker that can reach the API Connect gateway to trick the server into making outbound requests to internal network addresses. Because the built‑in protection that blocks requests to internal addresses can be bypassed, the gateway can access internal services and return portions of the responses, potentially leaking sensitive information.

The affected product is IBM API Connect. Versions from 12.1.0.0 through 12.1.1.2 are impacted; the fix is available in version 12.1.1.3.

The CVSS score of 7.2 categorizes the issue as high severity. The exploitation probability is unknown because the EPSS score is not available, but the vulnerability is exploitable over the network without local credentials. The issue is not listed in CISA’s KEV catalog, so no publicly known active exploits have been reported yet. An attacker with network access to the gateway can exercise this flaw by sending specially crafted requests that result in the gateway reaching internal services and leaking pieces of their responses.