CVE-2026-17299

Summary

The flaw allows authenticated attackers to read arbitrary files and perform server-side request forgery (SSRF) by exploiting unrestricted resolution of external references in submitted API definitions within IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2.

Exploitability

Exploitation requires valid authentication and the ability to submit API definitions containing external references, but is otherwise straightforward due to lack of input validation.

Blast radius

Successful exploitation could lead to exposure of sensitive internal files or internal system reconnaissance via SSRF, potentially enabling further compromise depending on network segmentation and service exposure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or 12.1.1.3 or later, where external reference resolution is properly restricted.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.