CVE-2026-17108

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability (CWE-918) that allows an authenticated remote attacker to access internal or external resources via the vulnerable server, potentially exposing sensitive information.

Exploitability

Exploitation requires valid authentication credentials and the ability to submit crafted requests to specific endpoints that perform SSRF-prone server-side requests without proper validation.

Blast radius

Successful exploitation could lead to exposure of internal network services, metadata service credentials, or other sensitive data accessible to the compromised API Connect instance.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which contains the fix for CVE-2026-17108.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.