{"id":"CVE-2026-17344","kind":"vulnerability","aliases":["CVE-2026-17344"],"related":[],"title":"IBM API Connect: unauthenticated server-side request forgery leaks sensitive information","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. A service that can be reached without authentication could be made to send requests to unintended destinations.","summary":"IBM's bulletin says a service in API Connect that can be reached without authentication can be made to send requests to unintended destinations, letting a remote attacker obtain sensitive information (CWE-918, IBM CVSS 9.3). IBM fixed it in v12.1.1.3. IBM does not name the specific endpoint.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted","ssrf","unauthenticated"],"not_affected_if":["versions-outside-range"],"how_to_check":"Check your API Connect V12 on-prem version. Versions v12.1.0.0 through v12.1.1.2 are affected per IBM; v12.1.1.3 is fixed. IBM does not name the vulnerable service, so also check which API Connect services are reachable from the internet without authentication, and review their outbound requests to internal addresses.","fix":"Upgrade IBM API Connect V12 on-prem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205).","status":"open","published_at":"2026-11-07T05:18:46+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","triaged_at":"2026-11-07T05:48:35+00:00","updated_at":"2026-11-07T05:54:04+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:48:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: server-side request forgery leaks sensitive information remotely","impact":"high","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker can make the server send requests to destinations of their choosing and so obtain sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker reads sensitive internal data via forged server requests","analyst_note":"Find IBM's security bulletin for CVE-2026-17344 to confirm the fixed version and which endpoints are affected.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`.\n- unknown for other checks; the sources do not say which endpoints or settings are exposed.","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-range"],"who_is_affected":"Teams running IBM API Connect in the affected version range. The sources describe an unauthenticated reachable service that can be made to send requests to unintended destinations, so internet-facing gateways are the most exposed. unknown for which deployment configurations are required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000687,"input_tokens":4215,"output_tokens":530,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17344 to confirm the fixed version and which endpoints are affected.","search":"'-17344':15A,18A '-2026':14A,17A '-918':68B '12.1.0.0':87C '12.1.1.2':89C '9.3':71B 'allow':91C 'api':2A,19A,24B,28B,43B,85C 'api-gateway':23B 'attack':63B,94C 'authent':50B,113C 'bulletin':38B 'connect':3A,20A,29B,44B,86C 'could':90C,114C 'cve':13A,16A 'cvss':70B 'cwe':67B 'destin':59B,122C 'due':99C 'endpoint':83B 'fix':73B 'forgeri':9A,105C 'gateway':25B 'host':33B 'ibm':1A,27B,36B,69B,72B,77B,84C 'ibm-api-connect':26B 'inform':12A,66B,98C 'infrastructur':30B 'leak':10A 'let':60B 'made':53B,116C 'name':80B 'obtain':64B,96C 'onprem':22A 'reach':48B,111C 'remot':62B,93C 'request':8A,56B,104C,119C 'say':39B 'self':32B 'self-host':31B 'send':55B,118C 'sensit':11A,65B,97C 'server':6A,102C 'server-sid':5A,101C 'servic':41B,107C 'side':7A,103C 'specif':82B 'ssrf':34B 'unauthent':4A,35B 'unintend':58B,121C 'v12':21A 'v12.1.1.3':76B 'without':49B,112C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM API Connect V12 on-prem, versions v12.1.0.0 to v12.1.1.2. IBM says an attacker needs no login, so exposure depends on whether the vulnerable service is reachable from the network. IBM's bulletin lists only API Connect V12 OnPrem as affected. Teams not running V12 on-prem can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:54:04Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1972},"products":{"at":"2026-11-07T05:54:04Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1972},"mitigations":{"at":"2026-11-07T05:54:04Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1972},"workarounds":{"at":"2026-11-07T05:54:04Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1972},"how_to_check":{"at":"2026-11-07T05:54:04Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1972},"who_affected":{"at":"2026-11-07T05:54:04Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1972}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","critical","ibmapiconnect","infrastructure","selfhosted","ssrf","unauthenticated"],"campaign_type":null,"search_a":"'-17344':15A,18A '-2026':14A,17A 'api':2A,19A 'connect':3A,20A 'cve':13A,16A 'forgeri':9A 'ibm':1A 'inform':12A 'leak':10A 'onprem':22A 'request':8A 'sensit':11A 'server':6A 'server-sid':5A 'side':7A 'unauthent':4A 'v12':21A","search_b":"'-918':68B '9.3':71B 'api':24B,28B,43B 'api-gateway':23B 'attack':63B 'authent':50B 'bulletin':38B 'connect':29B,44B 'cvss':70B 'cwe':67B 'destin':59B 'endpoint':83B 'fix':73B 'gateway':25B 'host':33B 'ibm':27B,36B,69B,72B,77B 'ibm-api-connect':26B 'inform':66B 'infrastructur':30B 'let':60B 'made':53B 'name':80B 'obtain':64B 'reach':48B 'remot':62B 'request':56B 'say':39B 'self':32B 'self-host':31B 'send':55B 'sensit':65B 'servic':41B 'specif':82B 'ssrf':34B 'unauthent':35B 'unintend':58B 'v12.1.1.3':76B 'without':49B","search_c":"'12.1.0.0':87C '12.1.1.2':89C 'allow':91C 'api':85C 'attack':94C 'authent':113C 'connect':86C 'could':90C,114C 'destin':122C 'due':99C 'forgeri':105C 'ibm':84C 'inform':98C 'made':116C 'obtain':96C 'reach':111C 'remot':93C 'request':104C,119C 'send':118C 'sensit':97C 'server':102C 'server-sid':101C 'servic':107C 'side':103C 'unintend':121C 'without':112C","first_public_at":"2026-11-07T05:18:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17344","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17344","severity":null,"published_at":"2026-11-07T05:18:46+00:00","modified_at":"2026-11-07T05:18:46+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","fetched_at":"2026-11-07T05:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17344:1972","url":"https://www.ibm.com/support/pages/node/7295635","severity":null,"published_at":"2026-11-07T05:54:04+00:00","modified_at":"2026-11-07T05:54:04+00:00","first_seen_at":"2026-11-07T05:54:04+00:00","fetched_at":"2026-11-07T05:54:04+00:00","note":"Read IBM bulletin node/7295635: CVE-2026-17344 SSRF, unauthenticated service, CVSS 9.3, affects V12 OnPrem 12.1.0.0-12.1.1.2, fix 12.1.1.3, workarounds None. Endpoint not named. Not exploited per sources seen (Feedly says no PoC); X not checked.","cites":["https://www.ibm.com/support/pages/node/7295635"]}],"documents":[{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}