CVE-2026-17228

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability (CWE-918) that allows an authenticated attacker to bypass destination restrictions on outbound HTTP requests, enabling access to internal or unintended resources and potential exposure of sensitive data.

Exploitability

Exploitation requires valid authentication credentials and the ability to submit crafted requests to vulnerable API endpoints that trigger outbound server requests.

Blast radius

Successful exploitation could lead to unauthorized access to internal services, metadata endpoints (e.g., cloud provider IMDS), or sensitive local files, compromising confidentiality and potentially enabling lateral movement.

Detection

Defenders should monitor for outbound HTTP/HTTPS requests from the API Connect gateway or management components to unexpected internal IP ranges (e.g., 10.x.x.x, 172.16.x.x–172.31.x.x, 192.168.x.x), localhost (127.0.0.1), or metadata endpoints (e.g., 169.254.169.254); anomalous DNS lookups for internal hostnames not normally resolved by the system may also be observed in gateway logs.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which includes fixes for this SSRF vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.