CVE-2026-16918

Summary

IBM API Connect contains a server-side request forgery (SSRF) vulnerability (CWE-918) that allows unauthenticated remote attackers to trick the appliance into making unintended requests to internal network services, potentially exposing internal resources.

Exploitability

Exploitation is straightforward for remote attackers as it requires no authentication, low privileges, or user interaction, and likely involves crafting malicious API requests that redirect internal HTTP calls to internal endpoints.

Blast radius

Successful exploitation could allow attackers to access internal services such as metadata endpoints, configuration servers, or management interfaces, leading to data exfiltration or further lateral movement within the internal network.

Detection

Defenders should monitor for anomalous internal HTTP requests originating from API Connect services—such as requests to loopback addresses (127.0.0.0/8), link-local addresses (169.254.0.0/16), or private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)—in proxy or access logs, especially when the source IP is the API Connect appliance itself.

Prioritized remediation

Upgrade IBM API Connect to version 10.0.8.13 or later for the 10.0.8.x branch, or to version 12.1.1.3 or later for the 12.1.x branch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.