{"id":"CVE-2026-17108","kind":"vulnerability","aliases":["CVE-2026-17108"],"related":[],"title":"IBM API Connect: authenticated SSRF lets attackers obtain sensitive information","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests to internal destinations and obtain sensitive information.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":"12.1.0.0 - 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["unaffected-version","unknown","version-outside-affected-ranges"],"how_to_check":"Check the installed API Connect V12 OnPrem version: affected are 12.1.0.0 to 12.1.1.2; fixed in 12.1.1.3. IBM's bulletin does not name the affected endpoint.","fix":"Upgrade API Connect V12 OnPrem to 12.1.1.3 (IBM Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:24+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","triaged_at":"2026-11-07T05:50:19+00:00","updated_at":"2026-11-07T06:25:08+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:50:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: authenticated SSRF lets attackers obtain sensitive information","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests to internal destinations and obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Sensitive internal data readable by an authenticated remote attacker","analyst_note":"Find IBM's security bulletin for CVE-2026-17108 to confirm the fixed version and the affected feature or endpoint.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown for other checks: the sources do not say which configuration or endpoints are exposed","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where remote users hold accounts. The sources do not state which features or configurations make the flaw reachable, so the exposure beyond the version range is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4193,"output_tokens":528,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17108 to confirm the fixed version and the affected feature or endpoint.","search":"'-17108':13A,16A '-2026':12A,15A '12.1.0.0':36B,70C '12.1.1.2':38B,72C 'account':53B 'allow':74C 'api':2A,17A,22B,26B,33B,68C 'api-gateway':21B 'attack':7A,49B,78C 'authent':4A,77C 'connect':3A,18A,27B,34B,69C 'contain':39B 'could':73C 'cve':11A,14A 'destin':62B 'due':83C 'flaw':46B 'forgeri':45B,89C 'gateway':23B 'host':30B 'ibm':1A,25B,32B,67C 'ibm-api-connect':24B 'inform':10A,66B,82C 'intern':61B 'let':6A 'make':55B 'obtain':8A,64B,80C 'onprem':20A 'remot':48B,76C 'request':44B,59B,88C 'self':29B 'self-host':28B 'send':58B 'sensit':9A,65B,81C 'server':42B,57B,86C 'server-sid':41B,85C 'side':43B,87C 'ssrf':5A 'v12':19A 'valid':52B 'vendor':31B 'version':35B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect V12 OnPrem 12.1.0.0-12.1.1.2. A user with a valid account can make the server send requests to destinations it should not reach and read the response; IBM rates it CVSS 8.5. IBM lists no workaround, so upgrading is the only remedy. Teams not running API Connect, or on other versions, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:25:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2071},"products":{"at":"2026-11-07T06:25:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2071},"mitigations":{"at":"2026-11-07T06:25:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2071},"workarounds":{"at":"2026-11-07T06:25:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2071},"how_to_check":{"at":"2026-11-07T06:25:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2071},"who_affected":{"at":"2026-11-07T06:25:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2071}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17108':13A,16A '-2026':12A,15A 'api':2A,17A 'attack':7A 'authent':4A 'connect':3A,18A 'cve':11A,14A 'ibm':1A 'inform':10A 'let':6A 'obtain':8A 'onprem':20A 'sensit':9A 'ssrf':5A 'v12':19A","search_b":"'12.1.0.0':36B '12.1.1.2':38B 'account':53B 'api':22B,26B,33B 'api-gateway':21B 'attack':49B 'connect':27B,34B 'contain':39B 'destin':62B 'flaw':46B 'forgeri':45B 'gateway':23B 'host':30B 'ibm':25B,32B 'ibm-api-connect':24B 'inform':66B 'intern':61B 'make':55B 'obtain':64B 'remot':48B 'request':44B,59B 'self':29B 'self-host':28B 'send':58B 'sensit':65B 'server':42B,57B 'server-sid':41B 'side':43B 'valid':52B 'vendor':31B 'version':35B","search_c":"'12.1.0.0':70C '12.1.1.2':72C 'allow':74C 'api':68C 'attack':78C 'authent':77C 'connect':69C 'could':73C 'due':83C 'forgeri':89C 'ibm':67C 'inform':82C 'obtain':80C 'remot':76C 'request':88C 'sensit':81C 'server':86C 'server-sid':85C 'side':87C","first_public_at":"2026-11-07T05:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17108","severity":null,"published_at":"2026-11-07T05:18:24+00:00","modified_at":"2026-11-07T05:18:24+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","fetched_at":"2026-11-07T05:45:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17108:2071","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:25:08+00:00","modified_at":"2026-11-07T06:25:08+00:00","first_seen_at":"2026-11-07T06:25:08+00:00","fetched_at":"2026-11-07T06:25:08+00:00","note":"Read IBM bulletin -39 (v12.1.1.3): CVE-2026-17108 SSRF, CWE-918, CVSS 8.5 AV:N/AC:L/PR:L/S:C. Affected V12 OnPrem 12.1.0.0-12.1.1.2, fix 12.1.1.3, workarounds None. Bulletin does not name the endpoint. No exploitation/PoC checked on X (not searched).","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}