{"id":"CVE-2026-17281","kind":"vulnerability","aliases":["CVE-2026-17281"],"related":[],"title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests on their behalf and read sensitive information in the responses.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-api-connect","self-hosted","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.","fix":"- Move to a release newer than the affected ranges; the sources do not name the fixed version.","status":"open","published_at":"2026-11-07T05:18:34+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","triaged_at":"2026-11-07T05:50:51+00:00","updated_at":"2026-11-07T05:50:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:50:51Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release newer than the affected ranges; the sources do not name the fixed version.","reach":"network","title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests on their behalf and read sensitive information in the responses.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive information from internal server responses","analyst_note":"Check the IBM security bulletin for this CVE to confirm the fixed version, the affected component and any required configuration.","how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks; the sources do not say which feature or configuration is involved.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Teams running IBM API Connect in the affected version ranges, where remote users hold accounts. The sources do not say which API Connect components or configurations are exposed, so the exact data path is unknown. Teams on other versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4225,"output_tokens":574,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-17281':17A,20A '-2026':16A,19A '10.0.8.0':33B,74C '10.0.8.12':35B,76C '12.1.0.0':37B,78C '12.1.1.2':39B,80C 'account':54B 'allow':82C 'api':2A,23B,30B,72C 'attack':50B,86C 'authent':13A,85C 'behalf':63B 'connect':3A,24B,31B,73C 'contain':40B 'could':81C 'cve':15A,18A 'due':91C 'flaw':47B 'forgeri':8A,46B,97C 'host':27B 'ibm':1A,22B,29B,71C 'ibm-api-connect':21B 'inform':11A,67B,90C 'leak':9A 'make':56B 'obtain':88C 'read':65B 'remot':49B,84C 'request':7A,45B,60B,96C 'respons':70B 'self':26B 'self-host':25B 'send':59B 'sensit':10A,66B,89C 'server':5A,43B,58B,94C 'server-sid':4A,42B,93C 'side':6A,44B,95C 'user':14A 'valid':53B 'vendor':28B 'version':32B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect in the affected version ranges, where remote users hold accounts. The sources do not say which API Connect components or configurations are exposed, so the exact data path is unknown. Teams on other versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17281':17A,20A '-2026':16A,19A 'api':2A 'authent':13A 'connect':3A 'cve':15A,18A 'forgeri':8A 'ibm':1A 'inform':11A 'leak':9A 'request':7A 'sensit':10A 'server':5A 'server-sid':4A 'side':6A 'user':14A","search_b":"'10.0.8.0':33B '10.0.8.12':35B '12.1.0.0':37B '12.1.1.2':39B 'account':54B 'api':23B,30B 'attack':50B 'behalf':63B 'connect':24B,31B 'contain':40B 'flaw':47B 'forgeri':46B 'host':27B 'ibm':22B,29B 'ibm-api-connect':21B 'inform':67B 'make':56B 'read':65B 'remot':49B 'request':45B,60B 'respons':70B 'self':26B 'self-host':25B 'send':59B 'sensit':66B 'server':43B,58B 'server-sid':42B 'side':44B 'valid':53B 'vendor':28B 'version':32B","search_c":"'10.0.8.0':74C '10.0.8.12':76C '12.1.0.0':78C '12.1.1.2':80C 'allow':82C 'api':72C 'attack':86C 'authent':85C 'connect':73C 'could':81C 'due':91C 'forgeri':97C 'ibm':71C 'inform':90C 'obtain':88C 'remot':84C 'request':96C 'sensit':89C 'server':94C 'server-sid':93C 'side':95C","first_public_at":"2026-11-07T05:18:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17281","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17281","severity":null,"published_at":"2026-11-07T05:18:34+00:00","modified_at":"2026-11-07T05:18:34+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","fetched_at":"2026-11-07T05:46:01+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}