{"id":"CVE-2026-16918","kind":"vulnerability","aliases":["CVE-2026-16918"],"related":[],"title":"IBM API Connect: server-side request forgery reaches internal network resources","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources due to server-side request forgery.","summary":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contains a server-side request forgery flaw. A remote attacker can make the server send requests into the internal network and reach resources that should be private.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["10.0.8.13","12.1.1.3"],"affected":">= 10.0.8.0, <= 10.0.8.12; >= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":[],"how_to_check":"Check your API Connect version. Affected: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. Fixed: 10.0.8.13 and 12.1.1.3. IBM's CVSS vector marks it as needing no authentication and no user interaction.","fix":"Upgrade to 10.0.8.13 (10.0.8.x line) or v12.1.1.3 (12.1.x line); IBM Fix Central. IBM's 12.1.1.3 link: https://www.ibm.com/support/pages/node/7290205","status":"open","published_at":"2026-11-07T05:18:22+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","triaged_at":"2026-11-07T05:48:38+00:00","updated_at":"2026-11-07T06:01:21+00:00","category":"vendor","confidence":0.75,"triage":{"at":"2026-11-07T05:48:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: server-side request forgery reaches internal network resources","impact":"medium","summary":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contains a server-side request forgery flaw. A remote attacker can make the server send requests into the internal network and reach resources that should be private.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reaches internal network resources through the API Connect server","analyst_note":"Check the IBM security bulletin for API Connect to confirm fixed versions and whether authentication or a special setting is required.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks: the sources do not say which configuration or feature is required","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges are exposed. The sources do not say which configuration or endpoints are required to trigger the flaw. unknown for who can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000683,"input_tokens":4218,"output_tokens":523,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for API Connect to confirm fixed versions and whether authentication or a special setting is required.","search":"'-16918':15A,18A '-2026':14A,17A '10.0.8.0':36B,74C '10.0.8.12':38B,76C '12.1.0.0':40B,78C '12.1.1.2':42B,80C 'access':87C 'allow':82C 'api':2A,20A,23B,27B,34B,72C 'api-connect':19A 'api-gateway':22B 'attack':53B,85C 'connect':3A,21A,28B,35B,73C 'contain':43B 'could':81C 'cve':13A,16A 'due':91C 'flaw':50B 'forgeri':8A,49B,97C 'gateway':24B 'host':31B 'ibm':1A,26B,33B,71C 'ibm-api-connect':25B 'intern':10A,62B,88C 'make':55B 'network':11A,63B,89C 'privat':70B 'reach':9A,65B 'remot':52B,84C 'request':7A,48B,59B,96C 'resourc':12A,66B,90C 'self':30B 'self-host':29B 'send':58B 'server':5A,46B,57B,94C 'server-sid':4A,45B,93C 'side':6A,47B,95C 'vendor':32B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2. IBM rates it 9.3 with network access and no login needed, so an outside attacker can make the server send requests to internal network resources. No special setting is named; the bulletin does not say which endpoint is involved. Anyone already on 10.0.8.13 or 12.1.1.3 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect"],"ptokens":["api","connect"],"labels":["apigateway","critical","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-16918':15A,18A '-2026':14A,17A 'api':2A,20A 'api-connect':19A 'connect':3A,21A 'cve':13A,16A 'forgeri':8A 'ibm':1A 'intern':10A 'network':11A 'reach':9A 'request':7A 'resourc':12A 'server':5A 'server-sid':4A 'side':6A","search_b":"'10.0.8.0':36B '10.0.8.12':38B '12.1.0.0':40B '12.1.1.2':42B 'api':23B,27B,34B 'api-gateway':22B 'attack':53B 'connect':28B,35B 'contain':43B 'flaw':50B 'forgeri':49B 'gateway':24B 'host':31B 'ibm':26B,33B 'ibm-api-connect':25B 'intern':62B 'make':55B 'network':63B 'privat':70B 'reach':65B 'remot':52B 'request':48B,59B 'resourc':66B 'self':30B 'self-host':29B 'send':58B 'server':46B,57B 'server-sid':45B 'side':47B 'vendor':32B","search_c":"'10.0.8.0':74C '10.0.8.12':76C '12.1.0.0':78C '12.1.1.2':80C 'access':87C 'allow':82C 'api':72C 'attack':85C 'connect':73C 'could':81C 'due':91C 'forgeri':97C 'ibm':71C 'intern':88C 'network':89C 'remot':84C 'request':96C 'resourc':90C 'server':94C 'server-sid':93C 'side':95C","first_public_at":"2026-11-07T05:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16918","severity":null,"published_at":"2026-11-07T05:18:22+00:00","modified_at":"2026-11-07T05:18:22+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","fetched_at":"2026-11-07T05:45:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-16918:1997","url":"https://www.ibm.com/support/pages/node/7295637","severity":null,"published_at":"2026-11-07T06:01:21+00:00","modified_at":"2026-11-07T06:01:21+00:00","first_seen_at":"2026-11-07T06:01:21+00:00","fetched_at":"2026-11-07T06:01:21+00:00","note":"IBM bulletin node/7295637 (10.0.8.13) lists CVE-2026-16918: SSRF, CVSS 9.3, vector AV:N/PR:N (no auth). Fix 10.0.8.13 read on IBM page; 12.1.1.3 fix and affected ranges come from the IBM CNA text via OpenCVE/NVD, not seen on a bulletin page (12.1.1.3 bulletin truncated), so nothing marked verified. No exploitation or PoC found.","cites":["https://www.ibm.com/support/pages/node/7295637","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93164,"url":"https://www.ibm.com/support/pages/node/7295637","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}