CVE-2026-17288

Summary

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a server-side request forgery (SSRF) vulnerability (CWE-918) that allows an authenticated attacker to force the application to make unintended requests to internal or external systems, potentially exposing sensitive data.

Exploitability

Exploitation requires valid authentication and low skill, as the flaw enables direct manipulation of backend HTTP requests via user-controlled input without complex obfuscation.

Blast radius

Successful exploitation could lead to unauthorized access to internal services, metadata endpoints (e.g., cloud provider IMDS), or sensitive APIs, compromising confidentiality of internal resources and enabling lateral movement.

Detection

Defenders should monitor for anomalous outbound HTTP/HTTPS requests from API Connect management or gateway nodes to unexpected internal IP ranges (e.g., 169.254.169.254), non-standard ports, or domains not in approved allowlists; look for such requests logged in access logs with elevated frequency or targeting sensitive endpoints like /v1/metadata or /internal/config.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or 12.1.1.3 or later, as these versions contain the vendor-provided fix for CVE-2026-17288.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.