CVE-2026-17325

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability due to insufficient validation of user-supplied URLs, allowing an authenticated attacker to access internal or sensitive resources by redirecting requests to unintended endpoints.

Exploitability

Exploitation requires valid authentication and minimal skill, as the flaw stems from improper URL validation rather than complex logic manipulation.

Blast radius

Successful exploitation could expose internal network services, credentials, or metadata stored in protected endpoints accessible to the API Connect server, potentially enabling further lateral movement or data exfiltration.

Detection

Defenders should monitor for anomalous outbound HTTP/HTTPS requests from the API Connect server to internal IP ranges (e.g., 10.x.x.x, 192.168.x.x, 172.16.x.x–172.31.x.x), localhost (127.0.0.1), or metadata services (e.g., 169.254.169.254) in web server or proxy logs, especially when triggered by authenticated API calls with suspicious URL parameters.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which addresses this SSRF vulnerability per vendor advisories.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.