{"id":"CVE-2026-17357","kind":"vulnerability","aliases":["CVE-2026-17357"],"related":[],"title":"IBM API Connect: authenticated users can reach internal services via SSRF","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network services due to server-side request forgery.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A logged-in attacker can make the server send requests to internal network services that the attacker cannot reach directly.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"IBM API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["no-authenticated-users","unaffected-version","version-outside-range"],"how_to_check":"Find your installed API Connect version. Affected: 10.0.8.0 through 10.0.8.12, and V12 OnPrem 12.1.0.0 through 12.1.1.2. Fixed: 10.0.8.13 and 12.1.1.3.","fix":"Upgrade to API Connect 10.0.8.13 (10.0.8 line) or v12.1.1.3 (V12 OnPrem), via IBM Fix Central. IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:47+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","triaged_at":"2026-11-07T05:52:01+00:00","updated_at":"2026-11-07T06:13:07+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:52:01Z","model":"claude-haiku-5-5","output":{"fix":"- unknown; the sources do not name a fixed version","reach":"internet","title":"IBM API Connect: authenticated users can reach internal services via SSRF","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A logged-in attacker can make the server send requests to internal network services that the attacker cannot reach directly.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"internal network services reachable from the API Connect server","analyst_note":"Confirm the fixed version and any workaround from the IBM security bulletin for CVE-2026-17357; the NVD entry alone gives no fix.","how_to_check":"- Check the installed IBM API Connect version against the affected ranges `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2`\n- unknown for any other check, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version","no-authenticated-users"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges are exposed. The attacker must hold a valid account on the platform. Deployments on versions outside the listed ranges are not affected per the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000706,"input_tokens":4222,"output_tokens":567,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any workaround from the IBM security bulletin for CVE-2026-17357; the NVD entry alone gives no fix.","search":"'-17357':14A,17A '-2026':13A,16A '10.0.8.0':41B,80C '10.0.8.12':43B,82C '12.1.0.0':45B,84C '12.1.1.2':47B,86C 'access':94C 'allow':88C 'api':2A,19A,22A,27B,31B,38B,78C 'api-gateway':26B 'attack':60B,73B,92C 'authent':4A,91C 'cannot':74B 'connect':3A,20A,23A,32B,39B,79C 'contain':48B 'could':87C 'cve':12A,15A 'direct':76B 'due':98C 'flaw':55B 'forgeri':54B,104C 'gateway':28B 'host':36B 'ibm':1A,18A,21A,30B,37B,77C 'ibm-api-connect':29B 'infrastructur':33B 'intern':8A,68B,95C 'log':58B 'logged-in':57B 'make':62B 'network':69B,96C 'onprem':25A 'reach':7A,75B 'remot':90C 'request':53B,66B,103C 'self':35B 'self-host':34B 'send':65B 'server':51B,64B,101C 'server-sid':50B,100C 'servic':9A,70B,97C 'side':52B,102C 'ssrf':11A 'user':5A 'v12':24A 'version':40B 'via':10A","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0-10.0.8.12 or V12 OnPrem 12.1.0.0-12.1.1.2. A logged-in user (IBM's CVSS vector requires high privileges) can make the server send requests to internal network services and read the result. IBM names no required setting and no workaround. Versions 10.0.8.13 / 12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:13:07Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2027},"products":{"at":"2026-11-07T06:13:07Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2027},"workarounds":{"at":"2026-11-07T06:13:07Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2027},"how_to_check":{"at":"2026-11-07T06:13:07Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2027},"who_affected":{"at":"2026-11-07T06:13:07Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2027}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","ibmapiconnect","ibmapiconnectv12onprem"],"ptokens":["api","connect","ibm","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17357':14A,17A '-2026':13A,16A 'api':2A,19A,22A 'authent':4A 'connect':3A,20A,23A 'cve':12A,15A 'ibm':1A,18A,21A 'intern':8A 'onprem':25A 'reach':7A 'servic':9A 'ssrf':11A 'user':5A 'v12':24A 'via':10A","search_b":"'10.0.8.0':41B '10.0.8.12':43B '12.1.0.0':45B '12.1.1.2':47B 'api':27B,31B,38B 'api-gateway':26B 'attack':60B,73B 'cannot':74B 'connect':32B,39B 'contain':48B 'direct':76B 'flaw':55B 'forgeri':54B 'gateway':28B 'host':36B 'ibm':30B,37B 'ibm-api-connect':29B 'infrastructur':33B 'intern':68B 'log':58B 'logged-in':57B 'make':62B 'network':69B 'reach':75B 'request':53B,66B 'self':35B 'self-host':34B 'send':65B 'server':51B,64B 'server-sid':50B 'servic':70B 'side':52B 'version':40B","search_c":"'10.0.8.0':80C '10.0.8.12':82C '12.1.0.0':84C '12.1.1.2':86C 'access':94C 'allow':88C 'api':78C 'attack':92C 'authent':91C 'connect':79C 'could':87C 'due':98C 'forgeri':104C 'ibm':77C 'intern':95C 'network':96C 'remot':90C 'request':103C 'server':101C 'server-sid':100C 'servic':97C 'side':102C","first_public_at":"2026-11-07T05:18:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17357","severity":null,"published_at":"2026-11-07T05:18:47+00:00","modified_at":"2026-11-07T05:18:47+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","fetched_at":"2026-11-07T05:46:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17357:2027","url":"https://www.ibm.com/support/pages/node/7295637","severity":null,"published_at":"2026-11-07T06:13:07+00:00","modified_at":"2026-11-07T06:13:07+00:00","first_seen_at":"2026-11-07T06:13:07+00:00","fetched_at":"2026-11-07T06:13:07+00:00","note":"Read IBM bulletins node/7295637 (10.0.8.13) and ...-ibm-api-connect-39 (v12.1.1.3; affected/fix/no workarounds read there); both list CVE-2026-17357, CWE-918, CVSS 7.6 (PR:H). 10.0.8 affected range taken from NVD/sibling, not seen in the truncated bulletin text. No exploitation/PoC found; social search skipped.","cites":["https://www.ibm.com/support/pages/node/7295637","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93164,"url":"https://www.ibm.com/support/pages/node/7295637","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}