{"id":"CVE-2026-17327","kind":"vulnerability","aliases":["CVE-2026-17327"],"related":[],"title":"IBM API Connect 12.1: authenticated SSRF lets a low-privileged user read sensitive information; fixed in 12.1.1.3","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM says API Connect could let a remote authenticated attacker obtain sensitive information through server-side request forgery (CWE-918, CVSS 8.5). It affects V12 OnPrem v12.1.0.0-v12.1.1.2 and is fixed in v12.1.1.3. IBM lists no workarounds.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","authenticated","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["auth-required","outside-affected-range"],"how_to_check":"Check your API Connect V12 OnPrem version. Versions v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 is fixed. IBM does not name the vulnerable endpoint.","fix":"Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:42+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","triaged_at":"2026-11-07T05:50:09+00:00","updated_at":"2026-11-07T06:17:36+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:50:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated SSRF lets attackers obtain sensitive information","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests on their behalf and read back sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads sensitive information from internal server requests","analyst_note":"Confirm the affected endpoint, required role, and IBM's fixed version from the IBM security bulletin for API Connect 12.1.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["outside-affected-range"],"who_is_affected":"IBM API Connect deployments in the 12.1.0.0 to 12.1.1.2 range are exposed to an authenticated remote attacker. Teams running API Connect outside that range are not affected by this entry. The sources do not describe the specific configuration or endpoint involved.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":4193,"output_tokens":507,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected endpoint, required role, and IBM's fixed version from the IBM security bulletin for API Connect 12.1.","search":"'-17327':21A,24A '-2026':20A,23A '-918':61B '12.1':4A '12.1.0.0':81C '12.1.1.2':83C '12.1.1.3':18A '8.5':63B 'affect':65B 'allow':85C 'api':2A,25A,30B,35B,43B,79C 'api-gateway':29B 'attack':50B,89C 'authent':5A,32B,49B,88C 'connect':3A,26A,36B,44B,80C 'could':45B,84C 'cve':19A,22A 'cvss':62B 'cwe':60B 'due':94C 'fix':16A,71B 'forgeri':59B,100C 'gateway':31B 'host':39B 'ibm':1A,34B,41B,74B,78C 'ibm-api-connect':33B 'inform':15A,53B,93C 'let':7A,46B 'list':75B 'low':10A 'low-privileg':9A 'obtain':51B,91C 'onprem':28A,67B 'privileg':11A 'read':13A 'remot':48B,87C 'request':58B,99C 'say':42B 'self':38B 'self-host':37B 'sensit':14A,52B,92C 'server':56B,97C 'server-sid':55B,96C 'side':57B,98C 'ssrf':6A 'user':12A 'v12':27A,66B 'v12.1.0.0-v12.1.1.2':68B 'v12.1.1.3':73B 'vendor':40B 'workaround':77B","nicknames":[],"mitigations":[],"who_affected":"IBM API Connect deployments in the 12.1.0.0 to 12.1.1.2 range are exposed to an authenticated remote attacker. Teams running API Connect outside that range are not affected by this entry. The sources do not describe the specific configuration or endpoint involved.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:17:36Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2041},"products":{"at":"2026-11-07T06:17:36Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2041},"workarounds":{"at":"2026-11-07T06:17:36Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2041},"how_to_check":{"at":"2026-11-07T06:17:36Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2041}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authenticated","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17327':21A,24A '-2026':20A,23A '12.1':4A '12.1.1.3':18A 'api':2A,25A 'authent':5A 'connect':3A,26A 'cve':19A,22A 'fix':16A 'ibm':1A 'inform':15A 'let':7A 'low':10A 'low-privileg':9A 'onprem':28A 'privileg':11A 'read':13A 'sensit':14A 'ssrf':6A 'user':12A 'v12':27A","search_b":"'-918':61B '8.5':63B 'affect':65B 'api':30B,35B,43B 'api-gateway':29B 'attack':50B 'authent':32B,49B 'connect':36B,44B 'could':45B 'cvss':62B 'cwe':60B 'fix':71B 'forgeri':59B 'gateway':31B 'host':39B 'ibm':34B,41B,74B 'ibm-api-connect':33B 'inform':53B 'let':46B 'list':75B 'obtain':51B 'onprem':67B 'remot':48B 'request':58B 'say':42B 'self':38B 'self-host':37B 'sensit':52B 'server':56B 'server-sid':55B 'side':57B 'v12':66B 'v12.1.0.0-v12.1.1.2':68B 'v12.1.1.3':73B 'vendor':40B 'workaround':77B","search_c":"'12.1.0.0':81C '12.1.1.2':83C 'allow':85C 'api':79C 'attack':89C 'authent':88C 'connect':80C 'could':84C 'due':94C 'forgeri':100C 'ibm':78C 'inform':93C 'obtain':91C 'remot':87C 'request':99C 'sensit':92C 'server':97C 'server-sid':96C 'side':98C","first_public_at":"2026-11-07T05:18:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17327","severity":null,"published_at":"2026-11-07T05:18:42+00:00","modified_at":"2026-11-07T05:18:43+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","fetched_at":"2026-11-07T05:46:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17327:2041","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:17:36+00:00","modified_at":"2026-11-07T06:17:36+00:00","first_seen_at":"2026-11-07T06:17:36+00:00","fetched_at":"2026-11-07T06:17:36+00:00","note":"Read IBM bulletin (node -39, 2026-11-05): CVE-2026-17327 SSRF, CVSS 8.5 (PR:L, scope changed, C:H), affects API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fixed v12.1.1.3, no workarounds. Bulletin does not name the endpoint or the role; no exploitation or PoC stated.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}