{"id":"CVE-2026-17288","kind":"vulnerability","aliases":["CVE-2026-17288"],"related":[],"title":"IBM API Connect 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2: authenticated user can use SSRF to obtain sensitive information; fixed in 10.0.8.13 and 12.1.1.3","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests to internal targets and read sensitive information in the responses.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":"10.0.8.0 - 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":"12.1.0.0 - 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["unaffected-version","version-outside-range"],"how_to_check":"Check the installed API Connect version: affected are 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2 (V12 OnPrem per IBM). Fixed in 10.0.8.13 and 12.1.1.3.","fix":"Upgrade to API Connect 10.0.8.13 (10.0.8.x) or 12.1.1.3 (12.1.x).","status":"open","published_at":"2026-11-07T05:18:35+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","triaged_at":"2026-11-07T05:50:15+00:00","updated_at":"2026-11-07T06:22:06+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-07T05:50:15Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed release listed in the IBM security bulletin (not named in the sources)","reach":"network","title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests to internal targets and read sensitive information in the responses.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker reads sensitive internal information through server-side requests","analyst_note":"Find the IBM security bulletin for CVE-2026-17288 to confirm fixed versions and the affected feature; the NVD entry alone does not name a fix.","how_to_check":"- Check the installed API Connect version against the affected ranges in the IBM advisory (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where authenticated users can reach the server-side request feature. The sources do not say which features or configurations trigger the flaw. Installations outside the listed ranges are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4225,"output_tokens":598,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-17288 to confirm fixed versions and the affected feature; the NVD entry alone does not name a fix.","search":"'-17288':25A,28A '-2026':24A,27A '10.0.8.0':4A,50B,91C '10.0.8.12':5A,52B,93C '10.0.8.13':20A '12.1.0.0':7A,54B,95C '12.1.1.2':8A,56B,97C '12.1.1.3':22A 'account':71B 'allow':99C 'api':2A,29A,31A,36B,40B,47B,89C 'api-gateway':35B 'attack':67B,103C 'authent':9A,102C 'connect':3A,30A,32A,41B,48B,90C 'contain':57B 'could':98C 'cve':23A,26A 'due':108C 'fix':18A 'flaw':64B 'forgeri':63B,114C 'gateway':37B 'host':44B 'ibm':1A,39B,46B,88C 'ibm-api-connect':38B 'inform':17A,84B,107C 'intern':79B 'make':73B 'obtain':15A,105C 'onprem':34A 'read':82B 'remot':66B,101C 'request':62B,77B,113C 'respons':87B 'self':43B 'self-host':42B 'send':76B 'sensit':16A,83B,106C 'server':60B,75B,111C 'server-sid':59B,110C 'side':61B,112C 'ssrf':13A 'target':80B 'use':12A 'user':10A 'v12':33A 'valid':70B 'vendor':45B 'version':49B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2. Any logged-in user can make the server send requests to internal targets and read back sensitive information. IBM lists no workaround, so upgrading is the only remedy. Teams not running API Connect can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:22:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2059},"products":{"at":"2026-11-07T06:22:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2059},"mitigations":{"at":"2026-11-07T06:22:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2059},"workarounds":{"at":"2026-11-07T06:22:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2059},"how_to_check":{"at":"2026-11-07T06:22:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2059},"who_affected":{"at":"2026-11-07T06:22:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2059}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","connect","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17288':25A,28A '-2026':24A,27A '10.0.8.0':4A '10.0.8.12':5A '10.0.8.13':20A '12.1.0.0':7A '12.1.1.2':8A '12.1.1.3':22A 'api':2A,29A,31A 'authent':9A 'connect':3A,30A,32A 'cve':23A,26A 'fix':18A 'ibm':1A 'inform':17A 'obtain':15A 'onprem':34A 'sensit':16A 'ssrf':13A 'use':12A 'user':10A 'v12':33A","search_b":"'10.0.8.0':50B '10.0.8.12':52B '12.1.0.0':54B '12.1.1.2':56B 'account':71B 'api':36B,40B,47B 'api-gateway':35B 'attack':67B 'connect':41B,48B 'contain':57B 'flaw':64B 'forgeri':63B 'gateway':37B 'host':44B 'ibm':39B,46B 'ibm-api-connect':38B 'inform':84B 'intern':79B 'make':73B 'read':82B 'remot':66B 'request':62B,77B 'respons':87B 'self':43B 'self-host':42B 'send':76B 'sensit':83B 'server':60B,75B 'server-sid':59B 'side':61B 'target':80B 'valid':70B 'vendor':45B 'version':49B","search_c":"'10.0.8.0':91C '10.0.8.12':93C '12.1.0.0':95C '12.1.1.2':97C 'allow':99C 'api':89C 'attack':103C 'authent':102C 'connect':90C 'could':98C 'due':108C 'forgeri':114C 'ibm':88C 'inform':107C 'obtain':105C 'remot':101C 'request':113C 'sensit':106C 'server':111C 'server-sid':110C 'side':112C","first_public_at":"2026-11-07T05:18:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17288","severity":null,"published_at":"2026-11-07T05:18:35+00:00","modified_at":"2026-11-07T05:18:35+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","fetched_at":"2026-11-07T05:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17288:2059","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:22:06+00:00","modified_at":"2026-11-07T06:22:06+00:00","first_seen_at":"2026-11-07T06:22:06+00:00","fetched_at":"2026-11-07T06:22:06+00:00","note":"Read both IBM bulletins (-41 for 10.0.8.x, -39 for 12.1.x). CVE listed in each: SSRF, CWE-918, CVSS 8.5 AV:N/PR:L/S:C/C:H/I:L. Fix 10.0.8.13 / 12.1.1.3; IBM states workarounds/mitigations: None. No exploitation or PoC seen (X not searched).","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}