{"id":"CVE-2026-17296","kind":"vulnerability","aliases":["CVE-2026-17296"],"related":[],"title":"IBM API Connect: authenticated server-side request forgery exposes sensitive information (fixed in 10.0.8.13 and 12.1.1.3)","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with an account can make the server send requests on their behalf and obtain sensitive information.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"api-connect-v12-onprem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","ibm-api-connect","self-hosted","ssrf","vendor"],"not_affected_if":["unknown"],"how_to_check":"Check your API Connect version. Affected: V10.0.8.0 - V10.0.8.12 and V12 OnPrem v12.1.0.0 - v12.1.1.2. Fixed: 10.0.8.13 and v12.1.1.3. Also review your API Connect instances' network access to internal services.","fix":"Upgrade to 10.0.8.13 (10.0.8.x) or v12.1.1.3 (12.1.x). IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:37+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","triaged_at":"2026-11-07T05:48:32+00:00","updated_at":"2026-11-07T05:58:21+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with an account can make the server send requests on their behalf and obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Sensitive information readable from internal services via server-side requests","analyst_note":"Check the IBM security bulletin for CVE-2026-17296 for the vulnerable endpoint, required role, and the fixed versions for the 10.0.8.x and 12.1.x branches.","how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks; the sources do not say which feature or endpoint is involved.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that run IBM API Connect in the affected version ranges, reachable by remote users with valid credentials. The sources do not name the vulnerable feature or endpoint, so exposure beyond the version ranges is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000708,"input_tokens":4226,"output_tokens":571,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for CVE-2026-17296 for the vulnerable endpoint, required role, and the fixed versions for the 10.0.8.x and 12.1.x branches.","search":"'-17296':20A,23A '-2026':19A,22A '10.0.8.0':48B,85C '10.0.8.12':50B,87C '10.0.8.13':15A '12.1.0.0':52B,89C '12.1.1.2':54B,91C '12.1.1.3':17A 'account':68B 'allow':93C 'api':2A,25A,28A,37B,45B,83C 'api-connect':24A 'api-connect-v12-onprem':27A 'attack':65B,97C 'auth':33B 'auth-requir':32B 'authent':4A,96C 'behalf':77B 'connect':3A,26A,29A,38B,46B,84C 'contain':55B 'could':92C 'cve':18A,21A 'due':102C 'expos':10A 'fix':13A 'flaw':62B 'forgeri':9A,61B,108C 'host':41B 'ibm':1A,36B,44B,82C 'ibm-api-connect':35B 'inform':12A,81B,101C 'make':70B 'obtain':79B,99C 'onprem':31A 'remot':64B,95C 'request':8A,60B,74B,107C 'requir':34B 'self':40B 'self-host':39B 'send':73B 'sensit':11A,80B,100C 'server':6A,58B,72B,105C 'server-sid':5A,57B,104C 'side':7A,59B,106C 'ssrf':42B 'v12':30A 'vendor':43B 'version':47B","nicknames":[],"mitigations":[],"who_affected":"Teams that run self-managed IBM API Connect 10.0.8.0 to 10.0.8.12 or V12 OnPrem 12.1.0.0 to 12.1.1.2. An attacker needs a valid account (low privileges) and can make the server send requests and read back sensitive data, with a changed scope (CVSS 9.6). IBM does not name the vulnerable endpoint. Teams on 10.0.8.13 or 12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:58:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1984},"products":{"at":"2026-11-07T05:58:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1984},"workarounds":{"at":"2026-11-07T05:58:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1984},"how_to_check":{"at":"2026-11-07T05:58:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1984},"who_affected":{"at":"2026-11-07T05:58:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1984}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["authrequired","critical","ibmapiconnect","selfhosted","ssrf","vendor"],"campaign_type":null,"search_a":"'-17296':20A,23A '-2026':19A,22A '10.0.8.13':15A '12.1.1.3':17A 'api':2A,25A,28A 'api-connect':24A 'api-connect-v12-onprem':27A 'authent':4A 'connect':3A,26A,29A 'cve':18A,21A 'expos':10A 'fix':13A 'forgeri':9A 'ibm':1A 'inform':12A 'onprem':31A 'request':8A 'sensit':11A 'server':6A 'server-sid':5A 'side':7A 'v12':30A","search_b":"'10.0.8.0':48B '10.0.8.12':50B '12.1.0.0':52B '12.1.1.2':54B 'account':68B 'api':37B,45B 'attack':65B 'auth':33B 'auth-requir':32B 'behalf':77B 'connect':38B,46B 'contain':55B 'flaw':62B 'forgeri':61B 'host':41B 'ibm':36B,44B 'ibm-api-connect':35B 'inform':81B 'make':70B 'obtain':79B 'remot':64B 'request':60B,74B 'requir':34B 'self':40B 'self-host':39B 'send':73B 'sensit':80B 'server':58B,72B 'server-sid':57B 'side':59B 'ssrf':42B 'vendor':43B 'version':47B","search_c":"'10.0.8.0':85C '10.0.8.12':87C '12.1.0.0':89C '12.1.1.2':91C 'allow':93C 'api':83C 'attack':97C 'authent':96C 'connect':84C 'could':92C 'due':102C 'forgeri':108C 'ibm':82C 'inform':101C 'obtain':99C 'remot':95C 'request':107C 'sensit':100C 'server':105C 'server-sid':104C 'side':106C","first_public_at":"2026-11-07T05:18:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17296","severity":null,"published_at":"2026-11-07T05:18:37+00:00","modified_at":"2026-11-07T05:18:37+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","fetched_at":"2026-11-07T05:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17296:1984","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T05:58:21+00:00","modified_at":"2026-11-07T05:58:21+00:00","first_seen_at":"2026-11-07T05:58:21+00:00","fetched_at":"2026-11-07T05:58:21+00:00","note":"Read IBM bulletins (-41 for 10.0.8.x, -39 for 12.1.x): both list CVE-2026-17296, fixes 10.0.8.13 and v12.1.1.3, workarounds None. IBM does not name the endpoint or role beyond 'authenticated'. No exploitation/PoC evidence found.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}