{"id":"CVE-2026-17355","kind":"vulnerability","aliases":["CVE-2026-17355"],"related":[],"title":"IBM API Connect: server-side request forgery exposes internal network resources","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to server-side request forgery. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems that should be blocked.","summary":"IBM API Connect 12.1.0.0 through 12.1.1.2 has a server-side request forgery flaw: destination checks on outbound requests can be bypassed. A remote attacker with an account can make the server reach internal systems it should block and read sensitive information from them.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","ssrf","vendor"],"not_affected_if":["unknown"],"how_to_check":"Find your installed IBM API Connect V12 on-prem version. v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 is fixed. The bulletin gives no version command.","fix":"Upgrade IBM API Connect to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:47+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","triaged_at":"2026-11-07T05:50:26+00:00","updated_at":"2026-11-07T06:14:12+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:50:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: server-side request forgery exposes internal network resources","impact":"medium","summary":"IBM API Connect 12.1.0.0 through 12.1.1.2 has a server-side request forgery flaw: destination checks on outbound requests can be bypassed. A remote attacker with an account can make the server reach internal systems it should block and read sensitive information from them.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive data from internal network systems through the server","analyst_note":"Confirm the fixed version and any workaround from the IBM security bulletin for CVE-2026-17355; the NVD entry alone gives no fix.","how_to_check":"- Check the installed IBM API Connect version against the affected range 12.1.0.0 through 12.1.1.2 (version command or admin console: unknown if the sources do not give the exact command).\n- unknown for other checks: the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organisations running IBM API Connect 12.1.0.0 through 12.1.1.2 where users with authenticated access can send outbound requests through the product. The sources do not describe other conditions. unknown for anything beyond the affected version range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000699,"input_tokens":4237,"output_tokens":551,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any workaround from the IBM security bulletin for CVE-2026-17355; the NVD entry alone gives no fix.","search":"'-17355':15A,18A '-2026':14A,17A '12.1.0.0':38B,80C '12.1.1.2':40B,82C 'account':62B 'allow':84C,114C 'api':2A,19A,24B,28B,36B,78C 'api-gateway':23B 'attack':59B,88C 'authent':87C 'block':72B,124C 'bypass':56B,111C 'check':50B,105C 'connect':3A,20A,29B,37B,79C 'could':83C,113C 'cve':13A,16A 'destin':49B,104C 'due':97C 'expos':9A 'flaw':48B 'forgeri':8A,47B,103C 'gateway':25B 'host':32B 'ibm':1A,27B,35B,77C 'ibm-api-connect':26B 'inform':76B,92C 'intern':10A,68B,94C,119C 'make':64B 'network':11A,95C 'obtain':90C 'onprem':22A 'outbound':52B,107C 'reach':67B,118C 'read':74B 'remot':58B,86C 'request':7A,46B,53B,102C,108C 'resourc':12A,96C 'self':31B 'self-host':30B 'sensit':75B,91C 'server':5A,44B,66B,100C,116C 'server-sid':4A,43B,99C 'side':6A,45B,101C 'ssrf':33B 'system':69B,120C 'v12':21A 'vendor':34B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted (on-prem) IBM API Connect V12, versions v12.1.0.0 through v12.1.1.2. An attacker needs a valid low-privilege account, then can bypass destination checks on outbound requests and reach internal systems. IBM lists no workaround. Others, including versions outside this range, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:14:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2029},"products":{"at":"2026-11-07T06:14:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2029},"workarounds":{"at":"2026-11-07T06:14:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2029},"how_to_check":{"at":"2026-11-07T06:14:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2029},"who_affected":{"at":"2026-11-07T06:14:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2029}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","selfhosted","ssrf","vendor"],"campaign_type":null,"search_a":"'-17355':15A,18A '-2026':14A,17A 'api':2A,19A 'connect':3A,20A 'cve':13A,16A 'expos':9A 'forgeri':8A 'ibm':1A 'intern':10A 'network':11A 'onprem':22A 'request':7A 'resourc':12A 'server':5A 'server-sid':4A 'side':6A 'v12':21A","search_b":"'12.1.0.0':38B '12.1.1.2':40B 'account':62B 'api':24B,28B,36B 'api-gateway':23B 'attack':59B 'block':72B 'bypass':56B 'check':50B 'connect':29B,37B 'destin':49B 'flaw':48B 'forgeri':47B 'gateway':25B 'host':32B 'ibm':27B,35B 'ibm-api-connect':26B 'inform':76B 'intern':68B 'make':64B 'outbound':52B 'reach':67B 'read':74B 'remot':58B 'request':46B,53B 'self':31B 'self-host':30B 'sensit':75B 'server':44B,66B 'server-sid':43B 'side':45B 'ssrf':33B 'system':69B 'vendor':34B","search_c":"'12.1.0.0':80C '12.1.1.2':82C 'allow':84C,114C 'api':78C 'attack':88C 'authent':87C 'block':124C 'bypass':111C 'check':105C 'connect':79C 'could':83C,113C 'destin':104C 'due':97C 'forgeri':103C 'ibm':77C 'inform':92C 'intern':94C,119C 'network':95C 'obtain':90C 'outbound':107C 'reach':118C 'remot':86C 'request':102C,108C 'resourc':96C 'sensit':91C 'server':100C,116C 'server-sid':99C 'side':101C 'system':120C","first_public_at":"2026-11-07T05:18:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17355","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17355","severity":null,"published_at":"2026-11-07T05:18:47+00:00","modified_at":"2026-11-07T05:18:47+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","fetched_at":"2026-11-07T05:46:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17355:2029","url":"https://www.ibm.com/support/pages/node/7295635","severity":null,"published_at":"2026-11-07T06:14:12+00:00","modified_at":"2026-11-07T06:14:12+00:00","first_seen_at":"2026-11-07T06:14:12+00:00","fetched_at":"2026-11-07T06:14:12+00:00","note":"Read IBM bulletin node/7295635: CVE-2026-17355 (CWE-918, 8.2) affects API Connect V12 OnPrem v12.1.0.0-v12.1.1.2; fix v12.1.1.3; workarounds: None. Bulletin bundles ~50 CVEs. No PoC/exploitation found; did not search social.","cites":["https://www.ibm.com/support/pages/node/7295635"]}],"documents":[{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}