{"id":"CVE-2026-17353","kind":"vulnerability","aliases":["CVE-2026-17353"],"related":[],"title":"IBM API Connect: server-side request forgery leaks data and bypasses restrictions","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to server-side request forgery.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A signed-in remote attacker can make the server send requests on their behalf, which can expose sensitive information and bypass security restrictions.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","authenticated","ibm-api-connect","self-hosted","ssrf","vendor"],"not_affected_if":["unknown"],"how_to_check":"Check your API Connect V12 OnPrem version. Versions v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 is fixed. IBM's 10.0.8.x line is not listed for this CVE. IBM lists no workaround.","fix":"Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:46+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","triaged_at":"2026-11-07T05:48:28+00:00","updated_at":"2026-11-07T05:53:16+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: server-side request forgery leaks data and bypasses restrictions","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A signed-in remote attacker can make the server send requests on their behalf, which can expose sensitive information and bypass security restrictions.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive information and bypasses security restrictions on the server","analyst_note":"Check the IBM security bulletin for CVE-2026-17353 for the fixed version and affected configurations; the NVD entry gives only the affected range.","how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` to `12.1.1.2`\n- unknown for other checks, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where remote users have accounts. The sources do not say which deployment settings make it reachable, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000681,"input_tokens":4203,"output_tokens":522,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for CVE-2026-17353 for the fixed version and affected configurations; the NVD entry gives only the affected range.","search":"'-17353':16A,19A '-2026':15A,18A '12.1.0.0':41B,79C '12.1.1.2':43B,81C 'allow':83C 'api':2A,20A,25B,30B,38B,77C 'api-gateway':24B 'attack':57B,87C 'authent':27B,86C 'behalf':66B 'bypass':12A,73B,93C 'connect':3A,21A,31B,39B,78C 'contain':44B 'could':82C 'cve':14A,17A 'data':10A 'due':96C 'expos':69B 'flaw':51B 'forgeri':8A,50B,102C 'gateway':26B 'host':34B 'ibm':1A,29B,37B,76C 'ibm-api-connect':28B 'inform':71B,91C 'leak':9A 'make':59B 'obtain':89C 'onprem':23A 'remot':56B,85C 'request':7A,49B,63B,101C 'restrict':13A,75B,95C 'secur':74B,94C 'self':33B 'self-host':32B 'send':62B 'sensit':70B,90C 'server':5A,47B,61B,99C 'server-sid':4A,46B,98C 'side':6A,48B,100C 'sign':54B 'signed-in':53B 'ssrf':35B 'v12':22A 'vendor':36B 'version':40B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed (on-prem) IBM API Connect V12, versions 12.1.0.0 through 12.1.1.2, where any authenticated user (even low-privilege) can reach the product. The flaw lets that user make the server send requests on their behalf, exposing sensitive data and bypassing restrictions. The 10.0.8.x line is not listed for this CVE in IBM's bulletins; those on 12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:53:16Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1971},"products":{"at":"2026-11-07T05:53:16Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1971},"how_to_check":{"at":"2026-11-07T05:53:16Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1971},"who_affected":{"at":"2026-11-07T05:53:16Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1971}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authenticated","critical","ibmapiconnect","selfhosted","ssrf","vendor"],"campaign_type":null,"search_a":"'-17353':16A,19A '-2026':15A,18A 'api':2A,20A 'bypass':12A 'connect':3A,21A 'cve':14A,17A 'data':10A 'forgeri':8A 'ibm':1A 'leak':9A 'onprem':23A 'request':7A 'restrict':13A 'server':5A 'server-sid':4A 'side':6A 'v12':22A","search_b":"'12.1.0.0':41B '12.1.1.2':43B 'api':25B,30B,38B 'api-gateway':24B 'attack':57B 'authent':27B 'behalf':66B 'bypass':73B 'connect':31B,39B 'contain':44B 'expos':69B 'flaw':51B 'forgeri':50B 'gateway':26B 'host':34B 'ibm':29B,37B 'ibm-api-connect':28B 'inform':71B 'make':59B 'remot':56B 'request':49B,63B 'restrict':75B 'secur':74B 'self':33B 'self-host':32B 'send':62B 'sensit':70B 'server':47B,61B 'server-sid':46B 'side':48B 'sign':54B 'signed-in':53B 'ssrf':35B 'vendor':36B 'version':40B","search_c":"'12.1.0.0':79C '12.1.1.2':81C 'allow':83C 'api':77C 'attack':87C 'authent':86C 'bypass':93C 'connect':78C 'could':82C 'due':96C 'forgeri':102C 'ibm':76C 'inform':91C 'obtain':89C 'remot':85C 'request':101C 'restrict':95C 'secur':94C 'sensit':90C 'server':99C 'server-sid':98C 'side':100C","first_public_at":"2026-11-07T05:18:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17353","severity":null,"published_at":"2026-11-07T05:18:46+00:00","modified_at":"2026-11-07T05:18:47+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","fetched_at":"2026-11-07T05:46:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17353:1971","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T05:53:16+00:00","modified_at":"2026-11-07T05:53:16+00:00","first_seen_at":"2026-11-07T05:53:16+00:00","fetched_at":"2026-11-07T05:53:16+00:00","note":"Read IBM bulletin (-39): CVE-2026-17353 listed, V12 OnPrem v12.1.0.0-v12.1.1.2, fixed in v12.1.1.3, IBM lists workarounds: None. Not in the 10.0.8.13 bulletin. No exploitation/PoC found (Feedly says none).","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}