{"id":"CVE-2026-17305","kind":"vulnerability","aliases":["CVE-2026-17305"],"related":[],"title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests on their behalf and obtain sensitive information.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2","fix":"- Move to a version fixed by IBM; the sources do not name the fixed version","status":"open","published_at":"2026-11-07T05:18:38+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","triaged_at":"2026-11-07T05:52:56+00:00","updated_at":"2026-11-07T05:52:56+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:52:56Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version fixed by IBM; the sources do not name the fixed version","reach":"network","title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests on their behalf and obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive information from internal server-side requests","analyst_note":"Check the IBM security bulletin for this CVE to get the fixed version and any required configuration; the NVD entry alone does not give them.","how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges. The flaw needs an authenticated remote user, so deployments that restrict or have no external user accounts are lower risk. unknown for specific configuration requirements.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4226,"output_tokens":569,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17305':17A,20A '-2026':16A,19A '10.0.8.0':36B,74C '10.0.8.12':38B,76C '12.1.0.0':40B,78C '12.1.1.2':42B,80C 'account':57B 'allow':82C 'api':2A,22B,26B,33B,72C 'api-gateway':21B 'attack':53B,86C 'authent':13A,85C 'behalf':66B 'connect':3A,27B,34B,73C 'contain':43B 'could':81C 'cve':15A,18A 'due':91C 'flaw':50B 'forgeri':8A,49B,97C 'gateway':23B 'host':30B 'ibm':1A,25B,32B,71C 'ibm-api-connect':24B 'inform':11A,70B,90C 'leak':9A 'make':59B 'obtain':68B,88C 'remot':52B,84C 'request':7A,48B,63B,96C 'self':29B 'self-host':28B 'send':62B 'sensit':10A,69B,89C 'server':5A,46B,61B,94C 'server-sid':4A,45B,93C 'side':6A,47B,95C 'user':14A 'valid':56B 'vendor':31B 'version':35B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges. The flaw needs an authenticated remote user, so deployments that restrict or have no external user accounts are lower risk. unknown for specific configuration requirements.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17305':17A,20A '-2026':16A,19A 'api':2A 'authent':13A 'connect':3A 'cve':15A,18A 'forgeri':8A 'ibm':1A 'inform':11A 'leak':9A 'request':7A 'sensit':10A 'server':5A 'server-sid':4A 'side':6A 'user':14A","search_b":"'10.0.8.0':36B '10.0.8.12':38B '12.1.0.0':40B '12.1.1.2':42B 'account':57B 'api':22B,26B,33B 'api-gateway':21B 'attack':53B 'behalf':66B 'connect':27B,34B 'contain':43B 'flaw':50B 'forgeri':49B 'gateway':23B 'host':30B 'ibm':25B,32B 'ibm-api-connect':24B 'inform':70B 'make':59B 'obtain':68B 'remot':52B 'request':48B,63B 'self':29B 'self-host':28B 'send':62B 'sensit':69B 'server':46B,61B 'server-sid':45B 'side':47B 'valid':56B 'vendor':31B 'version':35B","search_c":"'10.0.8.0':74C '10.0.8.12':76C '12.1.0.0':78C '12.1.1.2':80C 'allow':82C 'api':72C 'attack':86C 'authent':85C 'connect':73C 'could':81C 'due':91C 'forgeri':97C 'ibm':71C 'inform':90C 'obtain':88C 'remot':84C 'request':96C 'sensit':89C 'server':94C 'server-sid':93C 'side':95C","first_public_at":"2026-11-07T05:18:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17305","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17305","severity":null,"published_at":"2026-11-07T05:18:38+00:00","modified_at":"2026-11-07T05:18:38+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","fetched_at":"2026-11-07T05:46:02+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}