{"id":"CVE-2026-17352","kind":"vulnerability","aliases":["CVE-2026-17352"],"related":[],"title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect V12 OnPrem v12.1.0.0 through v12.1.1.2 has a server-side request forgery flaw (CVSS 8.5). A user with a valid account can make the server send requests and read back sensitive information. IBM fixes it in v12.1.1.3 and lists no workaround.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted","ssrf"],"not_affected_if":["outside-affected-range","v12.1.1.3-or-later"],"how_to_check":"Check your API Connect V12 OnPrem version. Versions v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 contains the fix. IBM lists no workaround. Also check any other API Connect release lines you run, since this bulletin covers only V12 OnPrem; IBM published separate bulletins for 10.0.8.x.","fix":"Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:46+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","triaged_at":"2026-11-07T05:50:05+00:00","updated_at":"2026-11-07T06:14:06+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:50:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests on their behalf and obtain sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker reads sensitive information the server can reach","analyst_note":"Check the IBM security bulletin for this CVE for the fixed version and affected features; the NVD entry alone gives only the range.","how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["outside-affected-range"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where users can log in to the platform. The sources do not say which features or configurations make the server-side request path reachable. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":4193,"output_tokens":491,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for this CVE for the fixed version and affected features; the NVD entry alone gives only the range.","search":"'-17352':17A,20A '-2026':16A,19A '12.1.0.0':84C '12.1.1.2':86C '8.5':54B 'account':60B 'allow':88C 'api':2A,21A,26B,30B,38B,82C 'api-gateway':25B 'attack':92C 'authent':13A,91C 'back':69B 'connect':3A,22A,31B,39B,83C 'could':87C 'cve':15A,18A 'cvss':53B 'due':97C 'fix':73B 'flaw':52B 'forgeri':8A,51B,103C 'gateway':27B 'host':35B 'ibm':1A,29B,37B,72B,81C 'ibm-api-connect':28B 'inform':11A,71B,96C 'infrastructur':32B 'leak':9A 'list':78B 'make':62B 'obtain':94C 'onprem':24A,41B 'read':68B 'remot':90C 'request':7A,50B,66B,102C 'self':34B 'self-host':33B 'send':65B 'sensit':10A,70B,95C 'server':5A,48B,64B,100C 'server-sid':4A,47B,99C 'side':6A,49B,101C 'ssrf':36B 'user':14A,56B 'v12':23A,40B 'v12.1.0.0':42B 'v12.1.1.2':44B 'v12.1.1.3':76B 'valid':59B 'workaround':80B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM API Connect V12 OnPrem v12.1.0.0 through v12.1.1.2. An attacker needs a valid account and can make the server send requests and get back sensitive information. IBM's bulletin does not name the feature that is affected. Teams on v12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:14:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2030},"products":{"at":"2026-11-07T06:14:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2030},"mitigations":{"at":"2026-11-07T06:14:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2030},"workarounds":{"at":"2026-11-07T06:14:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2030},"how_to_check":{"at":"2026-11-07T06:14:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2030},"who_affected":{"at":"2026-11-07T06:14:06Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2030}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","infrastructure","selfhosted","ssrf"],"campaign_type":null,"search_a":"'-17352':17A,20A '-2026':16A,19A 'api':2A,21A 'authent':13A 'connect':3A,22A 'cve':15A,18A 'forgeri':8A 'ibm':1A 'inform':11A 'leak':9A 'onprem':24A 'request':7A 'sensit':10A 'server':5A 'server-sid':4A 'side':6A 'user':14A 'v12':23A","search_b":"'8.5':54B 'account':60B 'api':26B,30B,38B 'api-gateway':25B 'back':69B 'connect':31B,39B 'cvss':53B 'fix':73B 'flaw':52B 'forgeri':51B 'gateway':27B 'host':35B 'ibm':29B,37B,72B 'ibm-api-connect':28B 'inform':71B 'infrastructur':32B 'list':78B 'make':62B 'onprem':41B 'read':68B 'request':50B,66B 'self':34B 'self-host':33B 'send':65B 'sensit':70B 'server':48B,64B 'server-sid':47B 'side':49B 'ssrf':36B 'user':56B 'v12':40B 'v12.1.0.0':42B 'v12.1.1.2':44B 'v12.1.1.3':76B 'valid':59B 'workaround':80B","search_c":"'12.1.0.0':84C '12.1.1.2':86C 'allow':88C 'api':82C 'attack':92C 'authent':91C 'connect':83C 'could':87C 'due':97C 'forgeri':103C 'ibm':81C 'inform':96C 'obtain':94C 'remot':90C 'request':102C 'sensit':95C 'server':100C 'server-sid':99C 'side':101C","first_public_at":"2026-11-07T05:18:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17352","severity":null,"published_at":"2026-11-07T05:18:46+00:00","modified_at":"2026-11-07T05:18:46+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","fetched_at":"2026-11-07T05:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17352:2030","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:14:06+00:00","modified_at":"2026-11-07T06:14:06+00:00","first_seen_at":"2026-11-07T06:14:06+00:00","fetched_at":"2026-11-07T06:14:06+00:00","note":"IBM bulletin (-39) lists CVE-2026-17352 among many; affected V12 OnPrem v12.1.0.0-v12.1.1.2, fix v12.1.1.3, workarounds None. Affected feature not stated. Bulletin has no exploitation info.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}