CVE-2026-17187

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an improper URL validation flaw (CWE-918) that allows an authenticated attacker to access sensitive internal information by supplying malicious URLs. This is a server-side request forgery (SSRF) vulnerability enabling data exfiltration.

Exploitability

Exploitation requires valid authentication and low skill, as it leverages standard HTTP requests to manipulated endpoints without user interaction.

Blast radius

Successful exploitation could expose internal network resources, credentials, or configuration data accessible to the API Connect server, potentially compromising downstream systems.

Detection

Defenders should monitor for anomalous outbound HTTP/HTTPS requests from the API Connect server to internal IP ranges (e.g., 10.x.x.x, 192.168.x.x, 172.16.x.x–172.31.x.x) or localhost addresses in web server or application logs; unusual URL parameters containing encoded internal endpoints may also appear in access logs.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which contains the fix for this SSRF vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.