{"id":"CVE-2026-17131","kind":"vulnerability","aliases":["CVE-2026-17131"],"related":[],"title":"IBM API Connect: server-side request forgery leaks sensitive information remotely","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 can be made to send requests to destinations it should not reach, because outbound request restrictions can be bypassed. An remote attacker can use the server to fetch internal responses and obtain sensitive information.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-api-connect","self-hosted","ssrf","vendor"],"not_affected_if":["outside-affected-version-range"],"how_to_check":"Check your API Connect V12 OnPrem version. Versions v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 contains the fix. IBM lists no workaround.","fix":"Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:26+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","triaged_at":"2026-11-07T05:48:38+00:00","updated_at":"2026-11-07T06:00:21+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: server-side request forgery leaks sensitive information remotely","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 can be made to send requests to destinations it should not reach, because outbound request restrictions can be bypassed. An remote attacker can use the server to fetch internal responses and obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker reads sensitive internal data via server requests","analyst_note":"Confirm fixed version and required auth or configuration from the IBM security bulletin for CVE-2026-17131.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown for other checks, the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["outside-affected-version-range"],"who_is_affected":"IBM API Connect deployments in the affected 12.1 range are exposed if their gateway or management components accept requests from untrusted parties. Teams running other versions or not using API Connect can skip it. The sources do not describe required configuration beyond the version range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000684,"input_tokens":4227,"output_tokens":522,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm fixed version and required auth or configuration from the IBM security bulletin for CVE-2026-17131.","search":"'-17131':15A,18A '-2026':14A,17A '12.1.0.0':36B,76C '12.1.1.2':38B,78C 'allow':80C 'api':2A,19A,25B,33B,74C 'attack':60B,83C 'bypass':57B,101C 'connect':3A,20A,26B,34B,75C 'contact':109C 'could':79C,105C 'cve':13A,16A 'destin':46B,111C 'due':88C 'fetch':66B 'forgeri':8A,94C 'host':29B 'ibm':1A,24B,32B,73C 'ibm-api-connect':23B 'inform':11A,72B,87C 'intern':67B 'leak':9A 'made':41B,107C 'obtain':70B,85C 'onprem':22A 'outbound':52B,97C 'reach':50B 'remot':12A,59B,82C 'request':7A,44B,53B,93C,98C 'respons':68B,115C 'restrict':54B,95C 'return':113C 'self':28B 'self-host':27B 'send':43B 'sensit':10A,71B,86C 'server':5A,64B,91C,104C 'server-sid':4A,90C 'side':6A,92C 'ssrf':30B 'unintend':110C 'use':62B 'v12':21A 'vendor':31B 'version':35B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted (OnPrem) IBM API Connect V12 installs running v12.1.0.0 through v12.1.1.2. IBM's description says a remote attacker can exploit it, and the CVSS vector says no authentication or user interaction is needed (PR:N). The server can be made to contact unintended destinations and return the response, because outbound request restrictions can be bypassed. Teams on other versions, or not using API Connect, can skip it; this bulletin lists only V12 OnPrem.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:00:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1993},"products":{"at":"2026-11-07T06:00:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1993},"mitigations":{"at":"2026-11-07T06:00:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1993},"workarounds":{"at":"2026-11-07T06:00:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1993},"how_to_check":{"at":"2026-11-07T06:00:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1993},"who_affected":{"at":"2026-11-07T06:00:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1993}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["critical","ibmapiconnect","selfhosted","ssrf","vendor"],"campaign_type":null,"search_a":"'-17131':15A,18A '-2026':14A,17A 'api':2A,19A 'connect':3A,20A 'cve':13A,16A 'forgeri':8A 'ibm':1A 'inform':11A 'leak':9A 'onprem':22A 'remot':12A 'request':7A 'sensit':10A 'server':5A 'server-sid':4A 'side':6A 'v12':21A","search_b":"'12.1.0.0':36B '12.1.1.2':38B 'api':25B,33B 'attack':60B 'bypass':57B 'connect':26B,34B 'destin':46B 'fetch':66B 'host':29B 'ibm':24B,32B 'ibm-api-connect':23B 'inform':72B 'intern':67B 'made':41B 'obtain':70B 'outbound':52B 'reach':50B 'remot':59B 'request':44B,53B 'respons':68B 'restrict':54B 'self':28B 'self-host':27B 'send':43B 'sensit':71B 'server':64B 'ssrf':30B 'use':62B 'vendor':31B 'version':35B","search_c":"'12.1.0.0':76C '12.1.1.2':78C 'allow':80C 'api':74C 'attack':83C 'bypass':101C 'connect':75C 'contact':109C 'could':79C,105C 'destin':111C 'due':88C 'forgeri':94C 'ibm':73C 'inform':87C 'made':107C 'obtain':85C 'outbound':97C 'remot':82C 'request':93C,98C 'respons':115C 'restrict':95C 'return':113C 'sensit':86C 'server':91C,104C 'server-sid':90C 'side':92C 'unintend':110C","first_public_at":"2026-11-07T05:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17131","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17131","severity":null,"published_at":"2026-11-07T05:18:26+00:00","modified_at":"2026-11-07T05:18:26+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","fetched_at":"2026-11-07T05:45:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17131:1993","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:00:21+00:00","modified_at":"2026-11-07T06:00:21+00:00","first_seen_at":"2026-11-07T06:00:21+00:00","fetched_at":"2026-11-07T06:00:21+00:00","note":"IBM bulletin (api-connect-39) lists CVE-2026-17131 as SSRF, CVSS 9.3, PR:N, fixed in v12.1.1.3; affected V12 OnPrem v12.1.0.0-v12.1.1.2 (page footer says -v12.1.1.3, table says 1.1.2); workarounds: None. Bulletin is a batch of many CVEs. No exploitation or PoC seen; did not search social.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}