CVE-2026-16912

Summary

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a server-side request forgery (SSRF) vulnerability (CWE-918) that allows an authenticated attacker to force the application to make unintended requests to internal or external systems, potentially exposing sensitive internal data or services.

Exploitability

Exploitation requires valid authentication credentials and no user interaction; the attack is straightforward for an authenticated low-privilege user due to the lack of input validation on SSRF-prone endpoints.

Blast radius

Successful exploitation could lead to unauthorized access to internal cloud metadata services, local network resources, or sensitive APIs, compromising confidentiality of internal systems and enabling further lateral movement.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or 12.1.1.3, which contain the vendor-provided fix for CVE-2026-16912.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.