{"id":"CVE-2026-17298","kind":"vulnerability","aliases":["CVE-2026-17298"],"related":[],"title":"IBM API Connect: authenticated SSRF leaks sensitive information to remote attackers","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with an account can make the server issue requests to internal destinations and read sensitive information in return.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"api-connect-v12-onprem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-connect","auth-required","ibm","self-hosted","vendor"],"not_affected_if":["auth-required","unaffected-version"],"how_to_check":"Check your installed API Connect version. Affected: 10.0.8.0 to 10.0.8.12 and v12.1.0.0 to v12.1.1.2 (IBM lists the 12.1 row as 'API Connect V12 OnPrem'). Fixed: 10.0.8.13 and v12.1.1.3.","fix":"Upgrade to 10.0.8.13 (10.0.8.x line) or v12.1.1.3 (v12.1.x line); IBM lists no workarounds or mitigations.","status":"open","published_at":"2026-11-07T05:18:37+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","triaged_at":"2026-11-07T05:48:08+00:00","updated_at":"2026-11-07T05:56:21+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated SSRF leaks sensitive information to remote attackers","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with an account can make the server issue requests to internal destinations and read sensitive information in return.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm","api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive internal information through forged server requests","analyst_note":"Check IBM's security bulletin for API Connect to confirm the fixed version and any required settings; the NVD entry gives only the affected ranges.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges are exposed, and the attacker must be able to log in to the platform. The sources do not say which features or configurations are required to reach the flawed request path. Teams on other versions or without API Connect can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000701,"input_tokens":4226,"output_tokens":557,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for API Connect to confirm the fixed version and any required settings; the NVD entry gives only the affected ranges.","search":"'-17298':14A,17A '-2026':13A,16A '10.0.8.0':41B,80C '10.0.8.12':43B,82C '12.1.0.0':45B,84C '12.1.1.2':47B,86C 'account':61B 'allow':88C 'api':2A,19A,22A,27B,38B,78C 'api-connect':18A,26B 'api-connect-v12-onprem':21A 'attack':11A,58B,92C 'auth':30B 'auth-requir':29B 'authent':4A,91C 'connect':3A,20A,23A,28B,39B,79C 'contain':48B 'could':87C 'cve':12A,15A 'destin':70B 'due':97C 'flaw':55B 'forgeri':54B,103C 'host':35B 'ibm':1A,32B,37B,77C 'inform':8A,74B,96C 'intern':69B 'issu':66B 'leak':6A 'make':63B 'obtain':94C 'onprem':25A 'read':72B 'remot':10A,57B,90C 'request':53B,67B,102C 'requir':31B 'return':76B 'self':34B 'self-host':33B 'sensit':7A,73B,95C 'server':51B,65B,100C 'server-sid':50B,99C 'side':52B,101C 'ssrf':5A 'v12':24A 'vendor':36B 'version':40B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect 10.0.8.0 to 10.0.8.12 or v12.1.0.0 to v12.1.1.2 (IBM lists the 12.1 row as On-Prem). An attacker needs a valid low-privilege account; they can then make the server request internal destinations and read the response. IBM does not say which feature or endpoint is involved. Teams on 10.0.8.13 / v12.1.1.3 or later, or without API Connect, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:56:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1982},"products":{"at":"2026-11-07T05:56:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1982},"workarounds":{"at":"2026-11-07T05:56:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1982},"how_to_check":{"at":"2026-11-07T05:56:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1982}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apiconnect","authrequired","critical","ibm","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17298':14A,17A '-2026':13A,16A 'api':2A,19A,22A 'api-connect':18A 'api-connect-v12-onprem':21A 'attack':11A 'authent':4A 'connect':3A,20A,23A 'cve':12A,15A 'ibm':1A 'inform':8A 'leak':6A 'onprem':25A 'remot':10A 'sensit':7A 'ssrf':5A 'v12':24A","search_b":"'10.0.8.0':41B '10.0.8.12':43B '12.1.0.0':45B '12.1.1.2':47B 'account':61B 'api':27B,38B 'api-connect':26B 'attack':58B 'auth':30B 'auth-requir':29B 'connect':28B,39B 'contain':48B 'destin':70B 'flaw':55B 'forgeri':54B 'host':35B 'ibm':32B,37B 'inform':74B 'intern':69B 'issu':66B 'make':63B 'read':72B 'remot':57B 'request':53B,67B 'requir':31B 'return':76B 'self':34B 'self-host':33B 'sensit':73B 'server':51B,65B 'server-sid':50B 'side':52B 'vendor':36B 'version':40B","search_c":"'10.0.8.0':80C '10.0.8.12':82C '12.1.0.0':84C '12.1.1.2':86C 'allow':88C 'api':78C 'attack':92C 'authent':91C 'connect':79C 'could':87C 'due':97C 'forgeri':103C 'ibm':77C 'inform':96C 'obtain':94C 'remot':90C 'request':102C 'sensit':95C 'server':100C 'server-sid':99C 'side':101C","first_public_at":"2026-11-07T05:18:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17298","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17298","severity":null,"published_at":"2026-11-07T05:18:37+00:00","modified_at":"2026-11-07T05:18:37+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","fetched_at":"2026-11-07T05:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17298:1982","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T05:56:21+00:00","modified_at":"2026-11-07T05:56:21+00:00","first_seen_at":"2026-11-07T05:56:21+00:00","fetched_at":"2026-11-07T05:56:21+00:00","note":"Read IBM bulletins (-41 for 10.0.8.x, -39 for 12.1.x): CVE listed, fix 10.0.8.13 / v12.1.1.3, no workarounds. IBM gives no feature/endpoint detail. Not exploited, no PoC seen.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}