CVE-2026-17397

Summary

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a server-side request forgery (SSRF) vulnerability (CWE-918) that allows an authenticated attacker to force the application to make unintended requests to internal or external systems, potentially exposing sensitive internal data or services.

Exploitability

Exploitation requires valid authentication and low skill, as the flaw is a classic SSRF pattern exploitable via crafted API requests targeting internal endpoints.

Blast radius

Successful exploitation could lead to unauthorized access to internal cloud metadata services, local network resources, or sensitive APIs, compromising confidentiality of internal systems and enabling lateral movement.

Detection

Defenders should monitor for anomalous outbound HTTP/HTTPS requests from API Connect management or gateway nodes to internal IP ranges (e.g., 10.x.x.x, 192.168.x.x, 169.254.x.x) or unexpected domains, especially when originating from authenticated user sessions with no legitimate business need for such requests.

Prioritized remediation

Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3 or later, as these versions include the fix for CVE-2026-17397.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.