{"id":"CVE-2026-17314","kind":"vulnerability","aliases":["CVE-2026-17314"],"related":[],"title":"IBM API Connect: authenticated SSRF lets attackers obtain sensitive information","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests on their behalf and read sensitive information in return.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`","fix":null,"status":"open","published_at":"2026-11-07T05:18:40+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","triaged_at":"2026-11-07T05:54:19+00:00","updated_at":"2026-11-07T05:54:19+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:54:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated SSRF lets attackers obtain sensitive information","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests on their behalf and read sensitive information in return.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive information from internal server-side resources","analyst_note":"Check the IBM security bulletin for API Connect 12.1.x for the fixed version and affected endpoint; the NVD entry alone gives no fix.","how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where users hold authenticated accounts. Deployments outside that version range are not listed as affected. The sources do not describe the specific configuration or endpoint involved.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000678,"input_tokens":4194,"output_tokens":517,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17314':13A,16A '-2026':12A,15A '12.1.0.0':29B,65C '12.1.1.2':31B,67C 'account':46B 'allow':69C 'api':2A,18B,22B,26B,63C 'api-gateway':17B 'attack':7A,42B,73C 'authent':4A,72C 'behalf':55B 'connect':3A,23B,27B,64C 'contain':32B 'could':68C 'cve':11A,14A 'due':78C 'flaw':39B 'forgeri':38B,84C 'gateway':19B 'ibm':1A,21B,25B,62C 'ibm-api-connect':20B 'inform':10A,59B,77C 'let':6A 'make':48B 'obtain':8A,75C 'read':57B 'remot':41B,71C 'request':37B,52B,83C 'return':61B 'send':51B 'sensit':9A,58B,76C 'server':35B,50B,81C 'server-sid':34B,80C 'side':36B,82C 'ssrf':5A 'valid':45B 'vendor':24B 'version':28B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where users hold authenticated accounts. Deployments outside that version range are not listed as affected. The sources do not describe the specific configuration or endpoint involved.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","medium","vendor"],"campaign_type":null,"search_a":"'-17314':13A,16A '-2026':12A,15A 'api':2A 'attack':7A 'authent':4A 'connect':3A 'cve':11A,14A 'ibm':1A 'inform':10A 'let':6A 'obtain':8A 'sensit':9A 'ssrf':5A","search_b":"'12.1.0.0':29B '12.1.1.2':31B 'account':46B 'api':18B,22B,26B 'api-gateway':17B 'attack':42B 'behalf':55B 'connect':23B,27B 'contain':32B 'flaw':39B 'forgeri':38B 'gateway':19B 'ibm':21B,25B 'ibm-api-connect':20B 'inform':59B 'make':48B 'read':57B 'remot':41B 'request':37B,52B 'return':61B 'send':51B 'sensit':58B 'server':35B,50B 'server-sid':34B 'side':36B 'valid':45B 'vendor':24B 'version':28B","search_c":"'12.1.0.0':65C '12.1.1.2':67C 'allow':69C 'api':63C 'attack':73C 'authent':72C 'connect':64C 'could':68C 'due':78C 'forgeri':84C 'ibm':62C 'inform':77C 'obtain':75C 'remot':71C 'request':83C 'sensit':76C 'server':81C 'server-sid':80C 'side':82C","first_public_at":"2026-11-07T05:18:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17314","severity":null,"published_at":"2026-11-07T05:18:40+00:00","modified_at":"2026-11-07T05:18:40+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","fetched_at":"2026-11-07T05:46:03+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}