{"id":"CVE-2026-17325","kind":"vulnerability","aliases":["CVE-2026-17325"],"related":[],"title":"IBM API Connect 12.1.0.0–12.1.1.2: authenticated user can make the server fetch attacker-chosen URLs and read sensitive data (SSRF)","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.","summary":"IBM's bulletin says API Connect could let a remote authenticated attacker obtain sensitive information because user-supplied URLs are not properly validated (CWE-918, server-side request forgery). CVSS 8.5. IBM does not say which data is exposed or which endpoint is involved. No exploitation or PoC found.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted","ssrf"],"not_affected_if":["no-untrusted-accounts","versions-outside-range"],"how_to_check":"Only API Connect V12 OnPrem is listed as affected, versions v12.1.0.0 through v12.1.1.2. Check your installed API Connect version; if it is in that range you are affected, and v12.1.1.3 or later is fixed. The bulletin does not name the endpoint or the data exposed.","fix":"Upgrade to IBM API Connect v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds or mitigations.","status":"open","published_at":"2026-11-07T05:18:42+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","triaged_at":"2026-11-07T05:50:11+00:00","updated_at":"2026-11-07T06:17:28+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:50:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated user can obtain sensitive information via URLs","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not properly validate user-supplied URLs. A remote attacker with a valid account can use this to obtain sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker obtains sensitive information from the server","analyst_note":"Find the IBM security bulletin for CVE-2026-17325 to confirm the fixed version, the exact sensitive data exposed, and any configuration requirements.","how_to_check":"- Check the installed IBM API Connect version against the affected range 12.1.0.0 through 12.1.1.2.\n- Review the IBM security bulletin for CVE-2026-17325 for the fixed version.","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-range","no-untrusted-accounts"],"who_is_affected":"Organizations running IBM API Connect in the 12.1.0.0 to 12.1.1.2 range are exposed to authenticated users. Exposure depends on who holds accounts on the platform; installations without untrusted or low-privilege users have less reason to worry. unknown whether specific configurations change exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.0007,"input_tokens":4199,"output_tokens":560,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-17325 to confirm the fixed version, the exact sensitive data exposed, and any configuration requirements.","search":"'-17325':24A,27A '-2026':23A,26A '-918':69B '12.1.0.0':4A,98C '12.1.1.2':5A,100C '8.5':76B 'allow':102C 'api':2A,28A,33B,37B,48B,96C 'api-gateway':32B 'attack':14A,55B,106C 'attacker-chosen':13A 'authent':6A,54B,105C 'bulletin':46B 'chosen':15A 'connect':3A,29A,38B,49B,97C 'could':50B,101C 'cve':22A,25A 'cvss':75B 'cwe':68B 'data':20A,82B 'due':111C 'endpoint':87B 'exploit':91B 'expos':84B 'fetch':12A 'forgeri':74B 'found':94B 'gateway':34B 'host':42B 'ibm':1A,36B,44B,77B,95C 'ibm-api-connect':35B 'improp':113C 'inform':58B,110C 'infrastructur':39B 'involv':89B 'let':51B 'make':9A 'obtain':56B,108C 'onprem':31A 'poc':93B 'proper':66B 'read':18A 'remot':53B,104C 'request':73B 'say':47B,80B 'self':41B 'self-host':40B 'sensit':19A,57B,109C 'server':11A,71B 'server-sid':70B 'side':72B 'ssrf':21A,43B 'suppli':62B,118C 'url':16A,63B,119C 'user':7A,61B,117C 'user-suppli':60B,116C 'v12':30A 'valid':67B,114C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted (OnPrem) IBM API Connect V12 installations from 12.1.0.0 to 12.1.1.2 are affected. An attacker needs a valid account on the platform; the server can then be made to retrieve content from URLs the attacker supplies. Installations on 12.1.1.3 or later, and those with no untrusted accounts, are at lower risk. IBM's bulletin lists the OnPrem product only; other deployment types are not confirmed affected.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:17:28Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2043},"products":{"at":"2026-11-07T06:17:28Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2043},"workarounds":{"at":"2026-11-07T06:17:28Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2043},"how_to_check":{"at":"2026-11-07T06:17:28Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2043},"who_affected":{"at":"2026-11-07T06:17:28Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2043}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","infrastructure","selfhosted","ssrf"],"campaign_type":null,"search_a":"'-17325':24A,27A '-2026':23A,26A '12.1.0.0':4A '12.1.1.2':5A 'api':2A,28A 'attack':14A 'attacker-chosen':13A 'authent':6A 'chosen':15A 'connect':3A,29A 'cve':22A,25A 'data':20A 'fetch':12A 'ibm':1A 'make':9A 'onprem':31A 'read':18A 'sensit':19A 'server':11A 'ssrf':21A 'url':16A 'user':7A 'v12':30A","search_b":"'-918':69B '8.5':76B 'api':33B,37B,48B 'api-gateway':32B 'attack':55B 'authent':54B 'bulletin':46B 'connect':38B,49B 'could':50B 'cvss':75B 'cwe':68B 'data':82B 'endpoint':87B 'exploit':91B 'expos':84B 'forgeri':74B 'found':94B 'gateway':34B 'host':42B 'ibm':36B,44B,77B 'ibm-api-connect':35B 'inform':58B 'infrastructur':39B 'involv':89B 'let':51B 'obtain':56B 'poc':93B 'proper':66B 'remot':53B 'request':73B 'say':47B,80B 'self':41B 'self-host':40B 'sensit':57B 'server':71B 'server-sid':70B 'side':72B 'ssrf':43B 'suppli':62B 'url':63B 'user':61B 'user-suppli':60B 'valid':67B","search_c":"'12.1.0.0':98C '12.1.1.2':100C 'allow':102C 'api':96C 'attack':106C 'authent':105C 'connect':97C 'could':101C 'due':111C 'ibm':95C 'improp':113C 'inform':110C 'obtain':108C 'remot':104C 'sensit':109C 'suppli':118C 'url':119C 'user':117C 'user-suppli':116C 'valid':114C","first_public_at":"2026-11-07T05:18:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17325","severity":null,"published_at":"2026-11-07T05:18:42+00:00","modified_at":"2026-11-07T05:18:42+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","fetched_at":"2026-11-07T05:46:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17325:2043","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:17:28+00:00","modified_at":"2026-11-07T06:17:28+00:00","first_seen_at":"2026-11-07T06:17:28+00:00","fetched_at":"2026-11-07T06:17:28+00:00","note":"IBM bulletin (multiple vulns, fixed in v12.1.1.3) read: CVE-2026-17325 CWE-918 SSRF, affected v12.1.0.0-12.1.1.2 OnPrem, fix 12.1.1.3, workarounds None. Data exposed and endpoint not stated. Sibling CVEs share the bulletin. No posts searched (low-profile B).","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}