CVE-2026-17365

Summary

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a server-side request forgery (SSRF) vulnerability (CWE-918) that allows an authenticated remote attacker to force the application to make unintended requests to internal or external systems, potentially exposing sensitive internal data or services.

Exploitability

Exploitation requires valid authentication credentials and no user interaction; the low attack complexity means a remote attacker with minimal privileges can readily trigger the SSRF.

Blast radius

Successful exploitation could lead to unauthorized access to internal network resources, cloud metadata endpoints, or backend services, resulting in data exfiltration of sensitive configuration or user information.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3 or later, as these versions contain the fix for CVE-2026-17365.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.