{"id":"CVE-2026-17237","kind":"vulnerability","aliases":["CVE-2026-17237"],"related":[],"title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests on their behalf and read sensitive information in return.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-api-connect","self-hosted","vendor"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2","fix":null,"status":"open","published_at":"2026-11-07T05:18:32+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","triaged_at":"2026-11-07T05:52:42+00:00","updated_at":"2026-11-07T05:52:42+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:52:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","impact":"low","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests on their behalf and read sensitive information in return.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Sensitive information readable through server-side requests","analyst_note":"Check IBM's security bulletin for API Connect for the fixed version and any configuration details; the NVD entry alone gives no fix or setup information.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where remote users hold authenticated accounts. The sources do not say which configuration or endpoints are involved, so teams should confirm their version and whether their deployment exposes the vulnerable functionality to authenticated users.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":4226,"output_tokens":558,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17237':17A,20A '-2026':16A,19A '10.0.8.0':33B,73C '10.0.8.12':35B,75C '12.1.0.0':37B,77C '12.1.1.2':39B,79C 'account':54B 'allow':81C 'api':2A,23B,30B,71C 'attack':50B,85C 'authent':13A,84C 'behalf':63B 'connect':3A,24B,31B,72C 'contain':40B 'could':80C 'cve':15A,18A 'due':90C 'flaw':47B 'forgeri':8A,46B,96C 'host':27B 'ibm':1A,22B,29B,70C 'ibm-api-connect':21B 'inform':11A,67B,89C 'leak':9A 'make':56B 'obtain':87C 'read':65B 'remot':49B,83C 'request':7A,45B,60B,95C 'return':69B 'self':26B 'self-host':25B 'send':59B 'sensit':10A,66B,88C 'server':5A,43B,58B,93C 'server-sid':4A,42B,92C 'side':6A,44B,94C 'user':14A 'valid':53B 'vendor':28B 'version':32B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges, where remote users hold authenticated accounts. The sources do not say which configuration or endpoints are involved, so teams should confirm their version and whether their deployment exposes the vulnerable functionality to authenticated users.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmapiconnect","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17237':17A,20A '-2026':16A,19A 'api':2A 'authent':13A 'connect':3A 'cve':15A,18A 'forgeri':8A 'ibm':1A 'inform':11A 'leak':9A 'request':7A 'sensit':10A 'server':5A 'server-sid':4A 'side':6A 'user':14A","search_b":"'10.0.8.0':33B '10.0.8.12':35B '12.1.0.0':37B '12.1.1.2':39B 'account':54B 'api':23B,30B 'attack':50B 'behalf':63B 'connect':24B,31B 'contain':40B 'flaw':47B 'forgeri':46B 'host':27B 'ibm':22B,29B 'ibm-api-connect':21B 'inform':67B 'make':56B 'read':65B 'remot':49B 'request':45B,60B 'return':69B 'self':26B 'self-host':25B 'send':59B 'sensit':66B 'server':43B,58B 'server-sid':42B 'side':44B 'valid':53B 'vendor':28B 'version':32B","search_c":"'10.0.8.0':73C '10.0.8.12':75C '12.1.0.0':77C '12.1.1.2':79C 'allow':81C 'api':71C 'attack':85C 'authent':84C 'connect':72C 'could':80C 'due':90C 'forgeri':96C 'ibm':70C 'inform':89C 'obtain':87C 'remot':83C 'request':95C 'sensit':88C 'server':93C 'server-sid':92C 'side':94C","first_public_at":"2026-11-07T05:18:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17237","severity":null,"published_at":"2026-11-07T05:18:32+00:00","modified_at":"2026-11-07T05:18:32+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","fetched_at":"2026-11-07T05:46:00+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}