{"id":"CVE-2026-17316","kind":"vulnerability","aliases":["CVE-2026-17316"],"related":[],"title":"IBM API Connect: server-side request forgery via unvalidated user input","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform server-side request forgery due to improper validation of user-supplied input.","summary":"IBM API Connect 12.1.0.0 through 12.1.1.2 does not properly validate user-supplied input. A remote attacker can make the server send requests to destinations of their choosing.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-api-connect","runtime","self-hosted","ssrf"],"not_affected_if":["unaffected-version"],"how_to_check":"Check your IBM API Connect V12 on-prem version. Versions v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 is the fixed release. IBM's bulletin does not name the vulnerable endpoint or a required configuration, so treat every instance in the range as exposed.","fix":"Upgrade IBM API Connect to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds or mitigations.","status":"open","published_at":"2026-11-07T05:18:40+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","triaged_at":"2026-11-07T05:52:15+00:00","updated_at":"2026-11-07T06:19:48+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-07T05:52:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: server-side request forgery via unvalidated user input","impact":"medium","summary":"IBM API Connect 12.1.0.0 through 12.1.1.2 does not properly validate user-supplied input. A remote attacker can make the server send requests to destinations of their choosing.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Server makes attacker-chosen internal requests, possibly exposing internal services","analyst_note":"Find IBM's security bulletin for CVE-2026-17316 to confirm the affected endpoint, required configuration and fixed version.","how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where remote users can reach the gateway or management endpoints. The sources do not say which request paths or features are involved. Installations outside that version range are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":4193,"output_tokens":484,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17316 to confirm the affected endpoint, required configuration and fixed version.","search":"'-17316':15A,18A '-2026':14A,17A '12.1.0.0':36B,64C '12.1.1.2':38B,66C 'allow':68C 'api':2A,20A,26B,34B,62C 'attack':49B,71C 'choos':60B 'connect':3A,21A,27B,35B,63C 'could':67C 'cve':13A,16A 'destin':57B 'due':79C 'forgeri':8A,78C 'host':31B 'ibm':1A,19A,25B,33B,61C 'ibm-api-connect':24B 'improp':81C 'input':12A,46B,87C 'make':51B 'onprem':23A 'perform':73C 'proper':41B 'remot':48B,70C 'request':7A,55B,77C 'runtim':28B 'self':30B 'self-host':29B 'send':54B 'server':5A,53B,75C 'server-sid':4A,74C 'side':6A,76C 'ssrf':32B 'suppli':45B,86C 'unvalid':10A 'user':11A,44B,85C 'user-suppli':43B,84C 'v12':22A 'valid':42B,82C 'via':9A","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM API Connect V12 (on-prem) at v12.1.0.0 through v12.1.1.2. A remote attacker needs no authentication (CVSS PR:N) and can make the server send requests to destinations the attacker picks. IBM does not name the endpoint or feature involved. Versions at v12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:19:48Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2050},"products":{"at":"2026-11-07T06:19:48Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2050},"mitigations":{"at":"2026-11-07T06:19:48Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2050},"workarounds":{"at":"2026-11-07T06:19:48Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2050},"how_to_check":{"at":"2026-11-07T06:19:48Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2050},"who_affected":{"at":"2026-11-07T06:19:48Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2050}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","ibmapiconnectv12onprem"],"ptokens":["api","connect","ibm","onprem","v12"],"labels":["high","ibmapiconnect","runtime","selfhosted","ssrf"],"campaign_type":null,"search_a":"'-17316':15A,18A '-2026':14A,17A 'api':2A,20A 'connect':3A,21A 'cve':13A,16A 'forgeri':8A 'ibm':1A,19A 'input':12A 'onprem':23A 'request':7A 'server':5A 'server-sid':4A 'side':6A 'unvalid':10A 'user':11A 'v12':22A 'via':9A","search_b":"'12.1.0.0':36B '12.1.1.2':38B 'api':26B,34B 'attack':49B 'choos':60B 'connect':27B,35B 'destin':57B 'host':31B 'ibm':25B,33B 'ibm-api-connect':24B 'input':46B 'make':51B 'proper':41B 'remot':48B 'request':55B 'runtim':28B 'self':30B 'self-host':29B 'send':54B 'server':53B 'ssrf':32B 'suppli':45B 'user':44B 'user-suppli':43B 'valid':42B","search_c":"'12.1.0.0':64C '12.1.1.2':66C 'allow':68C 'api':62C 'attack':71C 'connect':63C 'could':67C 'due':79C 'forgeri':78C 'ibm':61C 'improp':81C 'input':87C 'perform':73C 'remot':70C 'request':77C 'server':75C 'server-sid':74C 'side':76C 'suppli':86C 'user':85C 'user-suppli':84C 'valid':82C","first_public_at":"2026-11-07T05:18:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17316","severity":null,"published_at":"2026-11-07T05:18:40+00:00","modified_at":"2026-11-07T05:18:40+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","fetched_at":"2026-11-07T05:46:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17316:2050","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:19:48+00:00","modified_at":"2026-11-07T06:19:48+00:00","first_seen_at":"2026-11-07T06:19:48+00:00","fetched_at":"2026-11-07T06:19:48+00:00","note":"Read IBM bulletin (api-connect-39, 2026-11-05): CVE listed, affected API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fix v12.1.1.3, workarounds None. Bulletin gives no endpoint or config; exploit status not stated; no PoC found.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}