CVE-2026-17406

Summary

IBM API Connect contains a server-side request forgery (SSRF) vulnerability (CWE-918) where address validation can be bypassed by authenticated attackers, allowing the server to make unintended requests to internal or restricted destinations and potentially expose sensitive internal data.

Exploitability

Exploitation requires valid authentication credentials and knowledge of vulnerable endpoints that accept user-controlled URLs for backend requests; no public exploit code is available.

Blast radius

Successful exploitation could lead to unauthorized access to internal services, metadata endpoints, or cloud provider APIs (e.g., AWS IMDS), resulting in data exfiltration or further lateral movement within the infrastructure.

Detection

Defenders should monitor for anomalous outbound HTTP/HTTPS requests from API Connect gateway or management nodes to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.0/8), or cloud metadata endpoints (e.g., 169.254.169.254) in logs generated by the gateway or proxy components.

Prioritized remediation

Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3 or later, as these versions include patches for the SSRF vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.