{"id":"CVE-2026-17289","kind":"vulnerability","aliases":["CVE-2026-17289"],"related":[],"title":"IBM API Connect: authenticated users can read sensitive data via request forgery","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A logged-in attacker can make the server fetch internal resources and return sensitive information.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":"10.0.8.0 - 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":"12.1.0.0 - 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["unaffected-version","unauthenticated-only-access","versions-outside-range"],"how_to_check":"Check installed API Connect version: affected are 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2. Fixed in 10.0.8.13 and 12.1.1.3.","fix":"Upgrade to API Connect 10.0.8.13 (10.0.8.x) or 12.1.1.3 (12.1.x).","status":"open","published_at":"2026-11-07T05:18:35+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","triaged_at":"2026-11-07T05:50:47+00:00","updated_at":"2026-11-07T06:21:49+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:50:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can read sensitive data via request forgery","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A logged-in attacker can make the server fetch internal resources and return sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive information from internal server-side resources","analyst_note":"Check IBM's security bulletin for CVE-2026-17289 for the fixed versions and triggering configuration; the sources give only the NVD entry.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- Confirm the exact installed build with the product's version output; the sources do not name a command.","plain_action":"","needs_analyst":true,"not_affected_if":["unauthenticated-only-access","versions-outside-range"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges. Exposure requires an authenticated user with access to the platform; deployments on versions outside the listed ranges are not affected according to the sources. The sources do not say which features or configurations trigger the server-side request path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4225,"output_tokens":577,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for CVE-2026-17289 for the fixed versions and triggering configuration; the sources give only the NVD entry.","search":"'-17289':15A,18A '-2026':14A,17A '10.0.8.0':37B,71C '10.0.8.12':39B,73C '12.1.0.0':41B,75C '12.1.1.2':43B,77C 'allow':79C 'api':2A,19A,21A,27B,34B,69C 'attack':56B,83C 'authent':4A,82C 'connect':3A,20A,22A,28B,35B,70C 'contain':44B 'could':78C 'cve':13A,16A 'data':9A 'due':88C 'fetch':61B 'flaw':51B 'forgeri':12A,50B,94C 'host':32B 'ibm':1A,26B,33B,68C 'ibm-api-connect':25B 'inform':67B,87C 'infrastructur':29B 'intern':62B 'log':54B 'logged-in':53B 'make':58B 'obtain':85C 'onprem':24A 'read':7A 'remot':81C 'request':11A,49B,93C 'resourc':63B 'return':65B 'self':31B 'self-host':30B 'sensit':8A,66B,86C 'server':47B,60B,91C 'server-sid':46B,90C 'side':48B,92C 'user':5A 'v12':23A 'version':36B 'via':10A","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2. Any logged-in user can make the server send requests to internal resources and read back sensitive information. IBM lists no workaround, so upgrading is the only remedy. Teams not running API Connect can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:21:49Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2058},"products":{"at":"2026-11-07T06:21:49Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2058},"mitigations":{"at":"2026-11-07T06:21:49Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2058},"workarounds":{"at":"2026-11-07T06:21:49Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2058},"how_to_check":{"at":"2026-11-07T06:21:49Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2058},"who_affected":{"at":"2026-11-07T06:21:49Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2058}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","connect","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17289':15A,18A '-2026':14A,17A 'api':2A,19A,21A 'authent':4A 'connect':3A,20A,22A 'cve':13A,16A 'data':9A 'forgeri':12A 'ibm':1A 'onprem':24A 'read':7A 'request':11A 'sensit':8A 'user':5A 'v12':23A 'via':10A","search_b":"'10.0.8.0':37B '10.0.8.12':39B '12.1.0.0':41B '12.1.1.2':43B 'api':27B,34B 'attack':56B 'connect':28B,35B 'contain':44B 'fetch':61B 'flaw':51B 'forgeri':50B 'host':32B 'ibm':26B,33B 'ibm-api-connect':25B 'inform':67B 'infrastructur':29B 'intern':62B 'log':54B 'logged-in':53B 'make':58B 'request':49B 'resourc':63B 'return':65B 'self':31B 'self-host':30B 'sensit':66B 'server':47B,60B 'server-sid':46B 'side':48B 'version':36B","search_c":"'10.0.8.0':71C '10.0.8.12':73C '12.1.0.0':75C '12.1.1.2':77C 'allow':79C 'api':69C 'attack':83C 'authent':82C 'connect':70C 'could':78C 'due':88C 'forgeri':94C 'ibm':68C 'inform':87C 'obtain':85C 'remot':81C 'request':93C 'sensit':86C 'server':91C 'server-sid':90C 'side':92C","first_public_at":"2026-11-07T05:18:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17289","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17289","severity":null,"published_at":"2026-11-07T05:18:35+00:00","modified_at":"2026-11-07T05:18:35+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","fetched_at":"2026-11-07T05:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17289:2058","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:21:49+00:00","modified_at":"2026-11-07T06:21:49+00:00","first_seen_at":"2026-11-07T06:21:49+00:00","fetched_at":"2026-11-07T06:21:49+00:00","note":"Read IBM bulletins -41 (10.0.8.x) and -39 (12.1.x): CVE listed as SSRF CWE-918, CVSS 7.7, fix 10.0.8.13 / 12.1.1.3, no workarounds. Affected ranges from NVD; -41 metadata inconsistent (.12 vs .13), used table. No exploitation/PoC checked (X not searched).","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}