CVE-2026-18836

Summary

IBM API Connect contains a server-side request forgery (SSRF) vulnerability in versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2, allowing unauthenticated remote attackers to force the server to make unintended HTTP requests to internal or external systems and exfiltrate responses containing sensitive information.

Exploitability

Exploitation is straightforward for remote attackers with network access to the vulnerable API Connect gateway, requiring only manipulation of user-controlled input that influences backend request destinations.

Blast radius

Successful exploitation could expose internal service endpoints, credentials, or metadata stored in responses, potentially enabling lateral movement or further compromise of connected systems.

Detection

Defenders should monitor gateway access logs for unexpected outbound HTTP requests to internal IP ranges (e.g., 10.x.x.x, 192.168.x.x, 172.16–31.x.x), localhost (127.0.0.1), or metadata services (169.254.169.254); anomalous request destinations not aligned with configured API endpoints may indicate SSRF attempts.

Prioritized remediation

Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3, which contain the vendor-provided fix for CVE-2026-18836.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.