{"id":"CVE-2026-17287","kind":"vulnerability","aliases":["CVE-2026-17287"],"related":[],"title":"IBM API Connect: authenticated SSRF lets attacker read internal responses","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated, so the server could be made to send requests to unintended destinations and return the results.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to validate user-supplied addresses, enabling server-side request forgery. A logged-in attacker can make the server send requests to unintended destinations and receive the results, exposing sensitive information.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["fixed-version","unauthenticated-only-access"],"how_to_check":"- Check the installed API Connect version against `10.0.8.12` and `12.1.1.2`\n- Review which API Connect features accept user-supplied URLs, and whether internal hosts are reachable from the gateway or management server","fix":"- Move to a release newer than the affected ranges (10.0.8.12 and 12.1.1.2 are the last affected builds); the exact fixed version is unknown from the sources","status":"open","published_at":"2026-11-07T05:18:35+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","triaged_at":"2026-11-07T05:50:16+00:00","updated_at":"2026-11-07T05:50:16+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:50:16Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release newer than the affected ranges (10.0.8.12 and 12.1.1.2 are the last affected builds); the exact fixed version is unknown from the sources","reach":"network","title":"IBM API Connect: authenticated SSRF lets attacker read internal responses","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to validate user-supplied addresses, enabling server-side request forgery. A logged-in attacker can make the server send requests to unintended destinations and receive the results, exposing sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"internal services reached and their responses returned to attacker","analyst_note":"Find the IBM security bulletin for CVE-2026-17287 to confirm the fixed version and which feature takes the user-supplied address.","how_to_check":"- Check the installed API Connect version against `10.0.8.12` and `12.1.1.2`\n- Review which API Connect features accept user-supplied URLs, and whether internal hosts are reachable from the gateway or management server\n- unknown for anything beyond the version range","plain_action":"","needs_analyst":true,"not_affected_if":["unauthenticated-only-access","fixed-version"],"who_is_affected":"Teams running IBM API Connect 10.0.8.x up to 10.0.8.12 or 12.1.x up to 12.1.1.2. An attacker needs a valid account on the platform, so deployments that restrict or do not expose authenticated access are at lower risk. unknown for which specific features are required to trigger it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000761,"input_tokens":4265,"output_tokens":669,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-17287':13A,16A '-2026':12A,15A '10.0.8.0':32B,76C '10.0.8.12':34B,78C '12.1.0.0':36B,80C '12.1.1.2':38B,82C 'address':45B,103C 'allow':84C 'api':2A,18B,22B,29B,74C 'api-gateway':17B 'attack':7A,56B,88C 'authent':4A,87C 'connect':3A,23B,30B,75C 'could':83C,111C 'cve':11A,14A 'destin':65B,119C 'due':93C 'enabl':46B 'expos':70B 'fail':39B 'forgeri':51B,99C 'gateway':19B 'host':27B 'ibm':1A,21B,28B,73C 'ibm-api-connect':20B 'inform':72B,92C 'infrastructur':24B 'intern':9A 'let':6A 'log':54B 'logged-in':53B 'made':113C 'make':58B 'obtain':90C 'read':8A 'receiv':67B 'remot':86C 'request':50B,62B,98C,116C 'respons':10A 'result':69B,123C 'return':121C 'self':26B 'self-host':25B 'send':61B,115C 'sensit':71B,91C 'server':48B,60B,96C,110C 'server-sid':47B,95C 'side':49B,97C 'ssrf':5A 'suffici':106C 'suppli':44B,102C 'unintend':64B,118C 'user':43B,101C 'user-suppli':42B,100C 'valid':41B,107C 'version':31B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect 10.0.8.x up to 10.0.8.12 or 12.1.x up to 12.1.1.2. An attacker needs a valid account on the platform, so deployments that restrict or do not expose authenticated access are at lower risk. unknown for which specific features are required to trigger it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17287':13A,16A '-2026':12A,15A 'api':2A 'attack':7A 'authent':4A 'connect':3A 'cve':11A,14A 'ibm':1A 'intern':9A 'let':6A 'read':8A 'respons':10A 'ssrf':5A","search_b":"'10.0.8.0':32B '10.0.8.12':34B '12.1.0.0':36B '12.1.1.2':38B 'address':45B 'api':18B,22B,29B 'api-gateway':17B 'attack':56B 'connect':23B,30B 'destin':65B 'enabl':46B 'expos':70B 'fail':39B 'forgeri':51B 'gateway':19B 'host':27B 'ibm':21B,28B 'ibm-api-connect':20B 'inform':72B 'infrastructur':24B 'log':54B 'logged-in':53B 'make':58B 'receiv':67B 'request':50B,62B 'result':69B 'self':26B 'self-host':25B 'send':61B 'sensit':71B 'server':48B,60B 'server-sid':47B 'side':49B 'suppli':44B 'unintend':64B 'user':43B 'user-suppli':42B 'valid':41B 'version':31B","search_c":"'10.0.8.0':76C '10.0.8.12':78C '12.1.0.0':80C '12.1.1.2':82C 'address':103C 'allow':84C 'api':74C 'attack':88C 'authent':87C 'connect':75C 'could':83C,111C 'destin':119C 'due':93C 'forgeri':99C 'ibm':73C 'inform':92C 'made':113C 'obtain':90C 'remot':86C 'request':98C,116C 'result':123C 'return':121C 'send':115C 'sensit':91C 'server':96C,110C 'server-sid':95C 'side':97C 'suffici':106C 'suppli':102C 'unintend':118C 'user':101C 'user-suppli':100C 'valid':107C","first_public_at":"2026-11-07T05:18:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17287","severity":null,"published_at":"2026-11-07T05:18:35+00:00","modified_at":"2026-11-07T05:18:35+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","fetched_at":"2026-11-07T05:46:01+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}