CVE-2026-17384

Summary

IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a server-side request forgery (SSRF) vulnerability (CWE-918) that allows an authenticated remote attacker to force the application to make unintended requests to internal or external systems, potentially exposing sensitive internal data or services.

Exploitability

Exploitation requires valid authentication and low skill level, with no user interaction needed beyond initial login.

Blast radius

Successful exploitation could lead to unauthorized access to internal network resources, cloud metadata services, or other backend systems accessible to the vulnerable API Connect instance, with high confidentiality impact.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or later, as this version contains the fix for CVE-2026-17384.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.