{"id":"CVE-2026-17228","kind":"vulnerability","aliases":["CVE-2026-17228"],"related":[],"title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Destination restrictions on outbound requests can be bypassed, which could allow the server to retrieve content from unintended resources.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 let a logged-in user bypass outbound destination restrictions. The server can then be made to fetch content from unintended internal or external resources, exposing sensitive information.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-api-connect","infrastructure","self-hosted","ssrf"],"not_affected_if":["unknown"],"how_to_check":"Check your IBM API Connect V12 OnPrem version. Versions v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 contains the fix. IBM lists no workaround.","fix":"Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:31+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","triaged_at":"2026-11-07T05:50:15+00:00","updated_at":"2026-11-07T06:23:06+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:50:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 let a logged-in user bypass outbound destination restrictions. The server can then be made to fetch content from unintended internal or external resources, exposing sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Server fetches unintended resources and returns sensitive information to the attacker","analyst_note":"Check the IBM security bulletin for this CVE for the fixed version and affected configuration; the NVD entry alone does not give a fix.","how_to_check":"- Check the installed IBM API Connect version against the affected range 12.1.0.0 through 12.1.1.2\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where users hold authenticated accounts. The sources do not say which configurations expose the outbound request path, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00068,"input_tokens":4232,"output_tokens":513,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for this CVE for the fixed version and affected configuration; the NVD entry alone does not give a fix.","search":"'-17228':17A,20A '-2026':16A,19A '12.1.0.0':38B,72C '12.1.1.2':40B,74C 'allow':76C,102C 'api':2A,21A,27B,35B,70C 'attack':80C 'authent':13A,79C 'bypass':47B,99C 'connect':3A,22A,28B,36B,71C 'content':59B,107C 'could':75C,101C 'cve':15A,18A 'destin':49B,92C 'due':85C 'expos':66B 'extern':64B 'fetch':58B 'forgeri':8A,91C 'host':32B 'ibm':1A,26B,34B,69C 'ibm-api-connect':25B 'inform':11A,68B,84C 'infrastructur':29B 'intern':62B 'leak':9A 'let':41B 'log':44B 'logged-in':43B 'made':56B 'obtain':82C 'onprem':24A 'outbound':48B,95C 'remot':78C 'request':7A,90C,96C 'resourc':65B,110C 'restrict':50B,93C 'retriev':106C 'self':31B 'self-host':30B 'sensit':10A,67B,83C 'server':5A,52B,88C,104C 'server-sid':4A,87C 'side':6A,89C 'ssrf':33B 'unintend':61B,109C 'user':14A,46B 'v12':23A 'version':37B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM API Connect V12 OnPrem v12.1.0.0 through v12.1.1.2. A logged-in user can bypass destination restrictions on outbound requests, so the server may fetch content from unintended internal or external resources and return sensitive information. IBM's bulletin lists only V12 OnPrem as affected, and it does not say which configuration exposes the path. Teams not running API Connect V12 can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:23:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2064},"products":{"at":"2026-11-07T06:23:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2064},"mitigations":{"at":"2026-11-07T06:23:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2064},"workarounds":{"at":"2026-11-07T06:23:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2064},"how_to_check":{"at":"2026-11-07T06:23:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2064},"who_affected":{"at":"2026-11-07T06:23:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2064}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["high","ibmapiconnect","infrastructure","selfhosted","ssrf"],"campaign_type":null,"search_a":"'-17228':17A,20A '-2026':16A,19A 'api':2A,21A 'authent':13A 'connect':3A,22A 'cve':15A,18A 'forgeri':8A 'ibm':1A 'inform':11A 'leak':9A 'onprem':24A 'request':7A 'sensit':10A 'server':5A 'server-sid':4A 'side':6A 'user':14A 'v12':23A","search_b":"'12.1.0.0':38B '12.1.1.2':40B 'api':27B,35B 'bypass':47B 'connect':28B,36B 'content':59B 'destin':49B 'expos':66B 'extern':64B 'fetch':58B 'host':32B 'ibm':26B,34B 'ibm-api-connect':25B 'inform':68B 'infrastructur':29B 'intern':62B 'let':41B 'log':44B 'logged-in':43B 'made':56B 'outbound':48B 'resourc':65B 'restrict':50B 'self':31B 'self-host':30B 'sensit':67B 'server':52B 'ssrf':33B 'unintend':61B 'user':46B 'version':37B","search_c":"'12.1.0.0':72C '12.1.1.2':74C 'allow':76C,102C 'api':70C 'attack':80C 'authent':79C 'bypass':99C 'connect':71C 'content':107C 'could':75C,101C 'destin':92C 'due':85C 'forgeri':91C 'ibm':69C 'inform':84C 'obtain':82C 'outbound':95C 'remot':78C 'request':90C,96C 'resourc':110C 'restrict':93C 'retriev':106C 'sensit':83C 'server':88C,104C 'server-sid':87C 'side':89C 'unintend':109C","first_public_at":"2026-11-07T05:18:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17228","severity":null,"published_at":"2026-11-07T05:18:31+00:00","modified_at":"2026-11-07T05:18:31+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","fetched_at":"2026-11-07T05:46:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17228:2064","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:23:06+00:00","modified_at":"2026-11-07T06:23:06+00:00","first_seen_at":"2026-11-07T06:23:06+00:00","fetched_at":"2026-11-07T06:23:06+00:00","note":"IBM bulletin (-39, Nov 5 2026) lists CVE-2026-17228: SSRF, CVSS 8.5, authenticated; affected V12 OnPrem 12.1.0.0-12.1.1.2, fixed 12.1.1.3, workarounds None. Not in the 10.0.8.x bulletin (-41). Exploitation/PoC not checked beyond bulletin.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}