{"id":"CVE-2026-17329","kind":"vulnerability","aliases":["CVE-2026-17329"],"related":[],"title":"IBM API Connect V12 OnPrem: unauthenticated server-side request forgery can leak sensitive information (fixed in 12.1.1.3)","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs.","summary":"IBM says API Connect V12 OnPrem v12.1.0.0 to v12.1.1.2 does not properly validate endpoint URLs (CWE-918, server-side request forgery). A remote attacker with no login can obtain sensitive information. IBM rates it CVSS 9.3.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","pre-auth","self-hosted","ssrf","vendor"],"not_affected_if":["v12.1.1.3-or-later"],"how_to_check":"Check your API Connect V12 OnPrem version; v12.1.0.0 through v12.1.1.2 are affected, v12.1.1.3 contains the fix. IBM's bulletin lists only V12 OnPrem; if you run another API Connect offering or version, confirm with IBM support.","fix":"Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:43+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","triaged_at":"2026-11-07T05:48:36+00:00","updated_at":"2026-11-07T05:55:05+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: endpoint URL validation flaw leaks sensitive information remotely","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not properly validate endpoint URLs. A remote attacker can use this to obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker obtains sensitive information from the API Connect deployment","analyst_note":"Find IBM's security bulletin for CVE-2026-17329 to confirm the fixed version, required configuration and what sensitive data is exposed.","how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000624,"input_tokens":4194,"output_tokens":410,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17329 to confirm the fixed version, required configuration and what sensitive data is exposed.","search":"'-17329':21A,24A '-2026':20A,23A '-918':60B '12.1.0.0':84C '12.1.1.2':86C '12.1.1.3':18A '9.3':80B 'allow':88C 'api':2A,25A,30B,34B,46B,82C 'api-gateway':29B 'attack':68B,91C 'auth':38B 'connect':3A,26A,35B,47B,83C 'could':87C 'cve':19A,22A 'cvss':79B 'cwe':59B 'due':96C 'endpoint':57B,101C 'fix':16A 'forgeri':11A,65B 'gateway':31B 'host':41B 'ibm':1A,33B,44B,76B,81C 'ibm-api-connect':32B 'improp':98C 'inform':15A,75B,95C 'leak':13A 'login':71B 'obtain':73B,93C 'onprem':5A,28A,49B 'pre':37B 'pre-auth':36B 'proper':55B 'rate':77B 'remot':67B,90C 'request':10A,64B 'say':45B 'self':40B 'self-host':39B 'sensit':14A,74B,94C 'server':8A,62B 'server-sid':7A,61B 'side':9A,63B 'ssrf':42B 'unauthent':6A 'url':58B,102C 'v12':4A,27A,48B 'v12.1.0.0':50B 'v12.1.1.2':52B 'valid':56B,99C 'vendor':43B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed (OnPrem) IBM API Connect V12, versions v12.1.0.0 to v12.1.1.2. IBM rates the flaw as exploitable over the network with no login, so any instance reachable by an attacker should be treated as exposed; the bulletin does not say which data leaks. Teams on v12.1.1.3 or later, or on other API Connect offerings not named in the bulletin, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:55:01Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1978},"products":{"at":"2026-11-07T05:55:01Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1978},"workarounds":{"at":"2026-11-07T05:55:01Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1978},"how_to_check":{"at":"2026-11-07T05:55:01Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1978},"who_affected":{"at":"2026-11-07T05:55:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1978}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","critical","ibmapiconnect","preauth","selfhosted","ssrf","vendor"],"campaign_type":null,"search_a":"'-17329':21A,24A '-2026':20A,23A '12.1.1.3':18A 'api':2A,25A 'connect':3A,26A 'cve':19A,22A 'fix':16A 'forgeri':11A 'ibm':1A 'inform':15A 'leak':13A 'onprem':5A,28A 'request':10A 'sensit':14A 'server':8A 'server-sid':7A 'side':9A 'unauthent':6A 'v12':4A,27A","search_b":"'-918':60B '9.3':80B 'api':30B,34B,46B 'api-gateway':29B 'attack':68B 'auth':38B 'connect':35B,47B 'cvss':79B 'cwe':59B 'endpoint':57B 'forgeri':65B 'gateway':31B 'host':41B 'ibm':33B,44B,76B 'ibm-api-connect':32B 'inform':75B 'login':71B 'obtain':73B 'onprem':49B 'pre':37B 'pre-auth':36B 'proper':55B 'rate':77B 'remot':67B 'request':64B 'say':45B 'self':40B 'self-host':39B 'sensit':74B 'server':62B 'server-sid':61B 'side':63B 'ssrf':42B 'url':58B 'v12':48B 'v12.1.0.0':50B 'v12.1.1.2':52B 'valid':56B 'vendor':43B","search_c":"'12.1.0.0':84C '12.1.1.2':86C 'allow':88C 'api':82C 'attack':91C 'connect':83C 'could':87C 'due':96C 'endpoint':101C 'ibm':81C 'improp':98C 'inform':95C 'obtain':93C 'remot':90C 'sensit':94C 'url':102C 'valid':99C","first_public_at":"2026-11-07T05:18:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17329","severity":null,"published_at":"2026-11-07T05:18:43+00:00","modified_at":"2026-11-07T05:18:43+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","fetched_at":"2026-11-07T05:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17329:1978","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T05:55:01+00:00","modified_at":"2026-11-07T05:55:05+00:00","first_seen_at":"2026-11-07T05:55:01+00:00","fetched_at":"2026-11-07T05:55:05+00:00","note":"Added who-affected paragraph from IBM bulletin.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}