API CONNECT V12 ONPREM · CVE-2026-17325 · Infrastructure
FIX → 12.1.1.3 ✓ verified
IBM's bulletin says API Connect could let a remote authenticated attacker obtain sensitive information because user-supplied URLs are not properly validated (CWE-918, server-side request forgery). CVSS 8.5. IBM does not say which data is exposed or which endpoint is involved. No exploitation or PoC found.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted (OnPrem) IBM API Connect V12 installations from 12.1.0.0 to 12.1.1.2 are affected. An attacker needs a valid account on the platform; the server can then be made to retrieve content from URLs the attacker supplies. Installations on 12.1.1.3 or later, and those with no untrusted accounts, are at lower risk. IBM's bulletin lists the OnPrem product only; other deployment types are not confirmed affected.
Not affected if no-untrusted-accounts, versions-outside-range
Who cares api-gateway, ibm-api-connect, self-hosted, ssrf
v12.1.0.0 through v12.1.1.2v12.1.1.3 or later is fixedIBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 12.1.1.3
v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)