{"id":"CVE-2026-17294","kind":"vulnerability","aliases":["CVE-2026-17294"],"related":[],"title":"IBM API Connect 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2: authenticated user can use SSRF to obtain sensitive information; fixed in 10.0.8.13 and 12.1.1.3","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests to internal targets and obtain sensitive information.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":"10.0.8.0 - 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":"12.1.0.0 - 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["unaffected-version"],"how_to_check":"Check the installed API Connect version: affected are 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2 (V12 OnPrem per IBM). Fixed in 10.0.8.13 and 12.1.1.3.","fix":"Upgrade to API Connect 10.0.8.13 (10.0.8.x) or 12.1.1.3 (12.1.x).","status":"open","published_at":"2026-11-07T05:18:36+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","triaged_at":"2026-11-07T05:50:11+00:00","updated_at":"2026-11-07T06:20:55+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-07T05:50:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests to internal targets and obtain sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker reads sensitive internal information through forged server requests","analyst_note":"Confirm the fixed versions and any mitigation from the IBM security bulletin for CVE-2026-17294; sources give only the affected ranges.","how_to_check":"- Check the installed API Connect version against the affected ranges `10.0.8.0` to `10.0.8.12` and `12.1.0.0` to `12.1.1.2`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges are exposed, since the flaw lies in the server handling outbound requests. Exposure depends on which accounts can reach the platform; the sources do not say which features or configurations are required. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4225,"output_tokens":548,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and any mitigation from the IBM security bulletin for CVE-2026-17294; sources give only the affected ranges.","search":"'-17294':25A,28A '-2026':24A,27A '10.0.8.0':4A,50B,88C '10.0.8.12':5A,52B,90C '10.0.8.13':20A '12.1.0.0':7A,54B,92C '12.1.1.2':8A,56B,94C '12.1.1.3':22A 'account':71B 'allow':96C 'api':2A,29A,31A,36B,40B,47B,86C 'api-gateway':35B 'attack':67B,100C 'authent':9A,99C 'connect':3A,30A,32A,41B,48B,87C 'contain':57B 'could':95C 'cve':23A,26A 'due':105C 'fix':18A 'flaw':64B 'forgeri':63B,111C 'gateway':37B 'host':45B 'ibm':1A,39B,46B,85C 'ibm-api-connect':38B 'inform':17A,84B,104C 'infrastructur':42B 'intern':79B 'make':73B 'obtain':15A,82B,102C 'onprem':34A 'remot':66B,98C 'request':62B,77B,110C 'self':44B 'self-host':43B 'send':76B 'sensit':16A,83B,103C 'server':60B,75B,108C 'server-sid':59B,107C 'side':61B,109C 'ssrf':13A 'target':80B 'use':12A 'user':10A 'v12':33A 'valid':70B 'version':49B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2. Any logged-in user can make the server send requests to internal targets and read back sensitive information. IBM lists no workaround, so upgrading is the only remedy. Teams not running API Connect can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:20:55Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2054},"products":{"at":"2026-11-07T06:20:55Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2054},"mitigations":{"at":"2026-11-07T06:20:55Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2054},"workarounds":{"at":"2026-11-07T06:20:55Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2054},"how_to_check":{"at":"2026-11-07T06:20:55Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2054},"who_affected":{"at":"2026-11-07T06:20:55Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2054}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","connect","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17294':25A,28A '-2026':24A,27A '10.0.8.0':4A '10.0.8.12':5A '10.0.8.13':20A '12.1.0.0':7A '12.1.1.2':8A '12.1.1.3':22A 'api':2A,29A,31A 'authent':9A 'connect':3A,30A,32A 'cve':23A,26A 'fix':18A 'ibm':1A 'inform':17A 'obtain':15A 'onprem':34A 'sensit':16A 'ssrf':13A 'use':12A 'user':10A 'v12':33A","search_b":"'10.0.8.0':50B '10.0.8.12':52B '12.1.0.0':54B '12.1.1.2':56B 'account':71B 'api':36B,40B,47B 'api-gateway':35B 'attack':67B 'connect':41B,48B 'contain':57B 'flaw':64B 'forgeri':63B 'gateway':37B 'host':45B 'ibm':39B,46B 'ibm-api-connect':38B 'inform':84B 'infrastructur':42B 'intern':79B 'make':73B 'obtain':82B 'remot':66B 'request':62B,77B 'self':44B 'self-host':43B 'send':76B 'sensit':83B 'server':60B,75B 'server-sid':59B 'side':61B 'target':80B 'valid':70B 'version':49B","search_c":"'10.0.8.0':88C '10.0.8.12':90C '12.1.0.0':92C '12.1.1.2':94C 'allow':96C 'api':86C 'attack':100C 'authent':99C 'connect':87C 'could':95C 'due':105C 'forgeri':111C 'ibm':85C 'inform':104C 'obtain':102C 'remot':98C 'request':110C 'sensit':103C 'server':108C 'server-sid':107C 'side':109C","first_public_at":"2026-11-07T05:18:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17294","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17294","severity":null,"published_at":"2026-11-07T05:18:36+00:00","modified_at":"2026-11-07T05:18:36+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","fetched_at":"2026-11-07T05:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17294:2054","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:20:55+00:00","modified_at":"2026-11-07T06:20:55+00:00","first_seen_at":"2026-11-07T06:20:55+00:00","fetched_at":"2026-11-07T06:20:55+00:00","note":"Read both IBM bulletins (…api-connect-41 for 10.0.8.x, …-39 for 12.1.x). CVE listed in each: SSRF, CWE-918, CVSS 8.5 (AV:N/PR:L/S:C/C:H). Fix 10.0.8.13 / 12.1.1.3; IBM states no workarounds or mitigations. No exploitation or PoC seen (X not searched). 10.0.8 table says 10.0.8.0-10.0.8.12 (metadata says .13, ignored).","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}