---
id: "CVE-2026-17131"
page: "https://infrastack.ai/live/CVE-2026-17131"
kind: "vulnerability"
aliases: ["CVE-2026-17131"]
title: "IBM API Connect: server-side request forgery leaks sensitive information remotely"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "API Connect V12 OnPrem", "fixed": ["12.1.1.3"], "affected": ">= 12.1.0.0, <= 12.1.1.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ibm-api-connect", "self-hosted", "ssrf", "vendor"]
not_affected_if: ["outside-affected-version-range"]
published_at: "2026-11-07T05:18:26+00:00"
first_seen_at: "2026-11-07T05:45:58+00:00"
updated_at: "2026-11-07T06:00:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17131", "first_seen_at": "2026-11-07T05:45:58+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39", "first_seen_at": "2026-11-07T06:00:21+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}]
exploit_sources: []
---

# IBM API Connect: server-side request forgery leaks sensitive information remotely

Link for people: https://infrastack.ai/live/CVE-2026-17131 (this .md is for agents)

IBM API Connect versions 12.1.0.0 through 12.1.1.2 can be made to send requests to destinations it should not reach, because outbound request restrictions can be bypassed. An remote attacker can use the server to fetch internal responses and obtain sensitive information.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:API Connect V12 OnPrem affected >= 12.1.0.0, <= 12.1.1.2 fixed 12.1.1.3

## How to check

Check your API Connect V12 OnPrem version. Versions v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 contains the fix. IBM lists no workaround.

## Fix

Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)

## Timeline

- 2026-11-07T05:45:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17131
- 2026-11-07T06:00:21+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39 — IBM bulletin (api-connect-39) lists CVE-2026-17131 as SSRF, CVSS 9.3, PR:N, fixed in v12.1.1.3; affected V12 OnPrem v12.1.0.0-v12.1.1.2 (page footer says -v12.1.1.3, table says 1.1.2); workarounds: None. Bulletin is a batch of many CVEs. No exploitation or PoC seen; did not search social.

## Documents

- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39

## From the sources

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_