API CONNECT V12 ONPREM · CVE-2026-17228 · Infrastructure
FIX → 12.1.1.3 ✓ verified
IBM API Connect versions 12.1.0.0 through 12.1.1.2 let a logged-in user bypass outbound destination restrictions. The server can then be made to fetch content from unintended internal or external resources, exposing sensitive information.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running self-hosted IBM API Connect V12 OnPrem v12.1.0.0 through v12.1.1.2. A logged-in user can bypass destination restrictions on outbound requests, so the server may fetch content from unintended internal or external resources and return sensitive information. IBM's bulletin lists only V12 OnPrem as affected, and it does not say which configuration exposes the path. Teams not running API Connect V12 can skip it.
Not affected if unknown
Who cares ibm-api-connect, self-hosted, ssrf
v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 contains the fixIBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Destination restrictions on outbound requests can be bypassed, which could allow the server to retrieve content from unintended resources.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 12.1.1.3
Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)