{"id":"CVE-2026-17361","kind":"vulnerability","aliases":["CVE-2026-17361"],"related":[],"title":"IBM API Connect: authenticated SSRF lets attackers obtain sensitive information","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker who holds valid credentials can make the server send requests on their behalf and read back sensitive information.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","ibm-api-connect","self-hosted","ssrf","vendor"],"not_affected_if":["version-outside-12.1.0.0-to-12.1.1.2"],"how_to_check":"Check your API Connect V12 OnPrem version; versions v12.1.0.0 through v12.1.1.2 are affected. Move to v12.1.1.3 or later.","fix":"Upgrade to IBM API Connect v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:48+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","triaged_at":"2026-11-07T05:50:42+00:00","updated_at":"2026-11-07T06:13:05+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:50:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated SSRF lets attackers obtain sensitive information","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker who holds valid credentials can make the server send requests on their behalf and read back sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads sensitive information through server-initiated requests","analyst_note":"Find IBM's security bulletin for CVE-2026-17361 to confirm the fixed version and any affected feature or setting.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-12.1.0.0-to-12.1.1.2"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where users with accounts can reach the server. The sources do not describe which features or endpoints trigger the request forgery, so teams should confirm their version and access exposure. Teams on other versions are outside the stated range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":4193,"output_tokens":541,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17361 to confirm the fixed version and any affected feature or setting.","search":"'-17361':13A,16A '-2026':12A,15A '12.1.0.0':36B,71C '12.1.1.2':38B,73C 'allow':75C 'api':2A,18A,25B,33B,69C 'attack':7A,49B,79C 'authent':4A,22B,78C 'back':65B 'behalf':62B 'connect':3A,19A,26B,34B,70C 'contain':39B 'could':74C 'credenti':53B 'cve':11A,14A 'due':84C 'flaw':46B 'forgeri':45B,90C 'hold':51B 'host':29B 'ibm':1A,17A,24B,32B,68C 'ibm-api-connect':23B 'inform':10A,67B,83C 'let':6A 'make':55B 'obtain':8A,81C 'onprem':21A 'read':64B 'remot':48B,77C 'request':44B,59B,89C 'self':28B 'self-host':27B 'send':58B 'sensit':9A,66B,82C 'server':42B,57B,87C 'server-sid':41B,86C 'side':43B,88C 'ssrf':5A,30B 'v12':20A 'valid':52B 'vendor':31B 'version':35B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM API Connect V12 OnPrem 12.1.0.0 through 12.1.1.2. An attacker needs a valid account; they can make the server send requests and read back sensitive information. IBM's bulletin does not name the endpoint. Other versions and managed offerings are not listed as affected in this bulletin.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:13:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2025},"products":{"at":"2026-11-07T06:13:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2025},"mitigations":{"at":"2026-11-07T06:13:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2025},"workarounds":{"at":"2026-11-07T06:13:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2025},"how_to_check":{"at":"2026-11-07T06:13:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2025},"who_affected":{"at":"2026-11-07T06:13:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2025}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","ibmapiconnectv12onprem"],"ptokens":["api","connect","ibm","onprem","v12"],"labels":["authenticated","high","ibmapiconnect","selfhosted","ssrf","vendor"],"campaign_type":null,"search_a":"'-17361':13A,16A '-2026':12A,15A 'api':2A,18A 'attack':7A 'authent':4A 'connect':3A,19A 'cve':11A,14A 'ibm':1A,17A 'inform':10A 'let':6A 'obtain':8A 'onprem':21A 'sensit':9A 'ssrf':5A 'v12':20A","search_b":"'12.1.0.0':36B '12.1.1.2':38B 'api':25B,33B 'attack':49B 'authent':22B 'back':65B 'behalf':62B 'connect':26B,34B 'contain':39B 'credenti':53B 'flaw':46B 'forgeri':45B 'hold':51B 'host':29B 'ibm':24B,32B 'ibm-api-connect':23B 'inform':67B 'make':55B 'read':64B 'remot':48B 'request':44B,59B 'self':28B 'self-host':27B 'send':58B 'sensit':66B 'server':42B,57B 'server-sid':41B 'side':43B 'ssrf':30B 'valid':52B 'vendor':31B 'version':35B","search_c":"'12.1.0.0':71C '12.1.1.2':73C 'allow':75C 'api':69C 'attack':79C 'authent':78C 'connect':70C 'could':74C 'due':84C 'forgeri':90C 'ibm':68C 'inform':83C 'obtain':81C 'remot':77C 'request':89C 'sensit':82C 'server':87C 'server-sid':86C 'side':88C","first_public_at":"2026-11-07T05:18:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17361","severity":null,"published_at":"2026-11-07T05:18:48+00:00","modified_at":"2026-11-07T05:18:48+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","fetched_at":"2026-11-07T05:46:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17361:2025","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:13:05+00:00","modified_at":"2026-11-07T06:13:05+00:00","first_seen_at":"2026-11-07T06:13:05+00:00","fetched_at":"2026-11-07T06:13:05+00:00","note":"Read IBM bulletin (api-connect-39): CVE-2026-17361 SSRF CWE-918 CVSS 7.7, API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fixed in v12.1.1.3, workarounds None. No exploitation or PoC checked beyond bulletin. Bulletin batches ~40 CVEs.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}