{"id":"CVE-2026-16912","kind":"vulnerability","aliases":["CVE-2026-16912"],"related":[],"title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server issue requests to internal targets and obtain sensitive information.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.","fix":"- Move to a version outside the affected ranges; the sources do not name the fixed release.","status":"open","published_at":"2026-11-07T05:18:22+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","triaged_at":"2026-11-07T05:50:21+00:00","updated_at":"2026-11-07T05:50:21+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:50:21Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version outside the affected ranges; the sources do not name the fixed release.","reach":"network","title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server issue requests to internal targets and obtain sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive internal data through server-side requests","analyst_note":"Confirm the fixed version and any configuration conditions from the IBM security bulletin for CVE-2026-16912.","how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running IBM API Connect in the affected version ranges, where remote users hold accounts. The sources do not say which deployment modes or configurations are exposed, so the exact scope is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4225,"output_tokens":558,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-16912':17A,20A '-2026':16A,19A '10.0.8.0':36B,74C '10.0.8.12':38B,76C '12.1.0.0':40B,78C '12.1.1.2':42B,80C 'account':57B 'allow':82C 'api':2A,22B,26B,33B,72C 'api-gateway':21B 'attack':53B,86C 'authent':13A,85C 'connect':3A,27B,34B,73C 'contain':43B 'could':81C 'cve':15A,18A 'due':91C 'flaw':50B 'forgeri':8A,49B,97C 'gateway':23B 'host':31B 'ibm':1A,25B,32B,71C 'ibm-api-connect':24B 'inform':11A,70B,90C 'infrastructur':28B 'intern':65B 'issu':62B 'leak':9A 'make':59B 'obtain':68B,88C 'remot':52B,84C 'request':7A,48B,63B,96C 'self':30B 'self-host':29B 'sensit':10A,69B,89C 'server':5A,46B,61B,94C 'server-sid':4A,45B,93C 'side':6A,47B,95C 'target':66B 'user':14A 'valid':56B 'version':35B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect in the affected version ranges, where remote users hold accounts. The sources do not say which deployment modes or configurations are exposed, so the exact scope is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-16912':17A,20A '-2026':16A,19A 'api':2A 'authent':13A 'connect':3A 'cve':15A,18A 'forgeri':8A 'ibm':1A 'inform':11A 'leak':9A 'request':7A 'sensit':10A 'server':5A 'server-sid':4A 'side':6A 'user':14A","search_b":"'10.0.8.0':36B '10.0.8.12':38B '12.1.0.0':40B '12.1.1.2':42B 'account':57B 'api':22B,26B,33B 'api-gateway':21B 'attack':53B 'connect':27B,34B 'contain':43B 'flaw':50B 'forgeri':49B 'gateway':23B 'host':31B 'ibm':25B,32B 'ibm-api-connect':24B 'inform':70B 'infrastructur':28B 'intern':65B 'issu':62B 'make':59B 'obtain':68B 'remot':52B 'request':48B,63B 'self':30B 'self-host':29B 'sensit':69B 'server':46B,61B 'server-sid':45B 'side':47B 'target':66B 'valid':56B 'version':35B","search_c":"'10.0.8.0':74C '10.0.8.12':76C '12.1.0.0':78C '12.1.1.2':80C 'allow':82C 'api':72C 'attack':86C 'authent':85C 'connect':73C 'could':81C 'due':91C 'forgeri':97C 'ibm':71C 'inform':90C 'obtain':88C 'remot':84C 'request':96C 'sensit':89C 'server':94C 'server-sid':93C 'side':95C","first_public_at":"2026-11-07T05:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16912","severity":null,"published_at":"2026-11-07T05:18:22+00:00","modified_at":"2026-11-07T05:18:22+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","fetched_at":"2026-11-07T05:45:57+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}