{"id":"CVE-2026-17187","kind":"vulnerability","aliases":["CVE-2026-17187"],"related":[],"title":"IBM API Connect: flawed URL validation leaks sensitive information to logged-in users","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not properly validate user-supplied URLs. A remote attacker with an account can use this to obtain sensitive information.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","authenticated","ibm-api-connect","infrastructure","self-hosted","ssrf"],"not_affected_if":["auth-required","version-outside-range"],"how_to_check":"Check your API Connect V12 on-prem version. Versions v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 contains the fix. IBM lists no workarounds.","fix":"Upgrade IBM API Connect to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:29+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","triaged_at":"2026-11-07T05:50:18+00:00","updated_at":"2026-11-07T06:24:07+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-07T05:50:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: flawed URL validation leaks sensitive information to logged-in users","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not properly validate user-supplied URLs. A remote attacker with an account can use this to obtain sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads sensitive information through URL handling","analyst_note":"Find IBM's security bulletin for CVE-2026-17187 to confirm the fixed version and which URL inputs are affected.","how_to_check":"- Check the installed API Connect version against the affected range 12.1.0.0 through 12.1.1.2 in the IBM product data.\n- unknown for any other check, as the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations running IBM API Connect in the 12.1.0.0 through 12.1.1.2 range. The sources do not describe which deployment configurations are exposed, so the exact data path is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000665,"input_tokens":4199,"output_tokens":491,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17187 to confirm the fixed version and which URL inputs are affected.","search":"'-17187':17A,20A '-2026':16A,19A '12.1.0.0':42B,69C '12.1.1.2':44B,71C 'account':58B 'allow':73C 'api':2A,21A,26B,31B,39B,67C 'api-gateway':25B 'attack':55B,77C 'authent':28B,76C 'connect':3A,22A,32B,40B,68C 'could':72C 'cve':15A,18A 'due':82C 'flaw':4A 'gateway':27B 'host':36B 'ibm':1A,30B,38B,66C 'ibm-api-connect':29B 'improp':84C 'inform':9A,65B,81C 'infrastructur':33B 'leak':7A 'log':12A 'logged-in':11A 'obtain':63B,79C 'onprem':24A 'proper':47B 'remot':54B,75C 'self':35B 'self-host':34B 'sensit':8A,64B,80C 'ssrf':37B 'suppli':51B,89C 'url':5A,52B,90C 'use':60B 'user':14A,50B,88C 'user-suppli':49B,87C 'v12':23A 'valid':6A,48B,85C 'version':41B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect V12 on-premises, versions 12.1.0.0 through 12.1.1.2. IBM describes it as improper validation of a user-supplied URL (server-side request forgery) that lets a logged-in remote user obtain sensitive information; the bulletin does not say which URL inputs are affected. IBM's table lists only V12 OnPrem; the 10.0.8.x line is not listed for this CVE in that bulletin.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:24:07Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2067},"products":{"at":"2026-11-07T06:24:07Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2067},"how_to_check":{"at":"2026-11-07T06:24:07Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2067},"who_affected":{"at":"2026-11-07T06:24:07Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2067}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authenticated","high","ibmapiconnect","infrastructure","selfhosted","ssrf"],"campaign_type":null,"search_a":"'-17187':17A,20A '-2026':16A,19A 'api':2A,21A 'connect':3A,22A 'cve':15A,18A 'flaw':4A 'ibm':1A 'inform':9A 'leak':7A 'log':12A 'logged-in':11A 'onprem':24A 'sensit':8A 'url':5A 'user':14A 'v12':23A 'valid':6A","search_b":"'12.1.0.0':42B '12.1.1.2':44B 'account':58B 'api':26B,31B,39B 'api-gateway':25B 'attack':55B 'authent':28B 'connect':32B,40B 'gateway':27B 'host':36B 'ibm':30B,38B 'ibm-api-connect':29B 'inform':65B 'infrastructur':33B 'obtain':63B 'proper':47B 'remot':54B 'self':35B 'self-host':34B 'sensit':64B 'ssrf':37B 'suppli':51B 'url':52B 'use':60B 'user':50B 'user-suppli':49B 'valid':48B 'version':41B","search_c":"'12.1.0.0':69C '12.1.1.2':71C 'allow':73C 'api':67C 'attack':77C 'authent':76C 'connect':68C 'could':72C 'due':82C 'ibm':66C 'improp':84C 'inform':81C 'obtain':79C 'remot':75C 'sensit':80C 'suppli':89C 'url':90C 'user':88C 'user-suppli':87C 'valid':85C","first_public_at":"2026-11-07T05:18:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17187","severity":null,"published_at":"2026-11-07T05:18:29+00:00","modified_at":"2026-11-07T05:18:29+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","fetched_at":"2026-11-07T05:45:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17187:2067","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:24:07+00:00","modified_at":"2026-11-07T06:24:07+00:00","first_seen_at":"2026-11-07T06:24:07+00:00","fetched_at":"2026-11-07T06:24:07+00:00","note":"IBM bulletin (api-connect-39, 2026-11-05) lists CVE-2026-17187 as SSRF (CWE-918), CVSS 8.5; affected API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fixed in v12.1.1.3; no workarounds. Bulletin text truncated by tools; CVE entry read via page summarizer, the affected/fix sections read from page tail. Which URL inputs are affected is not stated. No X check.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}