{"id":"CVE-2026-17365","kind":"vulnerability","aliases":["CVE-2026-17365"],"related":[],"title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests to internal targets and obtain sensitive information.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-api-connect","self-hosted","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"Check your API Connect version. Per IBM, affected is 10.0.8.0 to 10.0.8.12 (fixed in 10.0.8.13). The CVE record also lists 12.1.0.0 to 12.1.1.2, but IBM's bulletin names only the 10.0.8 stream. Any account on the instance that can submit URLs is a potential attacker, so review who holds accounts.","fix":"API Connect 10.0.8.x: upgrade to 10.0.8.13 (IBM bulletin node/7295637). 12.1.x: the CVE record (via OpenCVE) says upgrade to v12.1.1.3, but the v12.1.1.3 bulletin I read does not list this CVE; confirm with IBM before relying on it.","status":"open","published_at":"2026-11-07T05:18:48+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","triaged_at":"2026-11-07T05:50:04+00:00","updated_at":"2026-11-07T06:11:23+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-07T05:50:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests to internal targets and obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker reads sensitive internal information through server-side requests","analyst_note":"Check the IBM security bulletin for this CVE to confirm the fixed versions and any configuration conditions; the NVD entry gives only the description.","how_to_check":"- Confirm the installed API Connect version and compare it with the affected ranges `10.0.8.0` to `10.0.8.12` and `12.1.0.0` to `12.1.1.2`\n- unknown for any other check, since the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges. The sources say an authenticated remote attacker is needed, so exposure depends on who holds accounts on the instance. Other configurations are not described by the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0007,"input_tokens":4225,"output_tokens":554,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for this CVE to confirm the fixed versions and any configuration conditions; the NVD entry gives only the description.","search":"'-17365':17A,20A '-2026':16A,19A '10.0.8.0':36B,74C '10.0.8.12':38B,76C '12.1.0.0':40B,78C '12.1.1.2':42B,80C 'account':57B 'allow':82C 'api':2A,22A,26B,33B,72C 'api-connect':21A 'attack':53B,86C 'authent':13A,85C 'connect':3A,23A,27B,34B,73C 'contain':43B 'could':81C 'cve':15A,18A 'due':91C 'flaw':50B 'forgeri':8A,49B,97C 'host':30B 'ibm':1A,25B,32B,71C 'ibm-api-connect':24B 'inform':11A,70B,90C 'intern':65B 'leak':9A 'make':59B 'obtain':68B,88C 'remot':52B,84C 'request':7A,48B,63B,96C 'self':29B 'self-host':28B 'send':62B 'sensit':10A,69B,89C 'server':5A,46B,61B,94C 'server-sid':4A,45B,93C 'side':6A,47B,95C 'target':66B 'user':14A 'valid':56B 'vendor':31B 'version':35B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted IBM API Connect 10.0.8.0 to 10.0.8.12 is affected per IBM's bulletin. The attacker needs a valid account, so exposure depends on who can log in to the instance. The CVE record also lists 12.1.0.0 to 12.1.1.2, which IBM's 10.0.8.13 bulletin does not confirm. The bulletin does not say how the SSRF is triggered.","tier":"B","verified":{"mitigations":{"at":"2026-11-07T06:11:23Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295637","run_id":2023},"workarounds":{"at":"2026-11-07T06:11:23Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295637","run_id":2023}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect"],"ptokens":["api","connect"],"labels":["high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17365':17A,20A '-2026':16A,19A 'api':2A,22A 'api-connect':21A 'authent':13A 'connect':3A,23A 'cve':15A,18A 'forgeri':8A 'ibm':1A 'inform':11A 'leak':9A 'request':7A 'sensit':10A 'server':5A 'server-sid':4A 'side':6A 'user':14A","search_b":"'10.0.8.0':36B '10.0.8.12':38B '12.1.0.0':40B '12.1.1.2':42B 'account':57B 'api':26B,33B 'attack':53B 'connect':27B,34B 'contain':43B 'flaw':50B 'forgeri':49B 'host':30B 'ibm':25B,32B 'ibm-api-connect':24B 'inform':70B 'intern':65B 'make':59B 'obtain':68B 'remot':52B 'request':48B,63B 'self':29B 'self-host':28B 'send':62B 'sensit':69B 'server':46B,61B 'server-sid':45B 'side':47B 'target':66B 'valid':56B 'vendor':31B 'version':35B","search_c":"'10.0.8.0':74C '10.0.8.12':76C '12.1.0.0':78C '12.1.1.2':80C 'allow':82C 'api':72C 'attack':86C 'authent':85C 'connect':73C 'could':81C 'due':91C 'forgeri':97C 'ibm':71C 'inform':90C 'obtain':88C 'remot':84C 'request':96C 'sensit':89C 'server':94C 'server-sid':93C 'side':95C","first_public_at":"2026-11-07T05:18:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17365","severity":null,"published_at":"2026-11-07T05:18:48+00:00","modified_at":"2026-11-07T05:18:49+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","fetched_at":"2026-11-07T05:46:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17365:2023","url":"https://www.ibm.com/support/pages/node/7295637","severity":null,"published_at":"2026-11-07T06:11:23+00:00","modified_at":"2026-11-07T06:11:23+00:00","first_seen_at":"2026-11-07T06:11:23+00:00","fetched_at":"2026-11-07T06:11:23+00:00","note":"IBM bulletin node/7295637 lists CVE-2026-17365 (CVSS 8.5), affects 10.0.8.0-10.0.8.12, fix 10.0.8.13, workaround none. 12.1.x range and 12.1.1.3 fix come only from the CVE record; the 12.1.1.3 bulletin (-37) did not list this CVE in what I read, so left unverified. No exploitation or PoC found.","cites":["https://www.ibm.com/support/pages/node/7295637","https://app.opencve.io/cve/CVE-2026-17365"]}],"documents":[{"id":93164,"url":"https://www.ibm.com/support/pages/node/7295637","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93279,"url":"https://app.opencve.io/cve/CVE-2026-17365","title":"OpenCVE CVE-2026-17365 (CNA record: fix 12.1.1.3 / 10.0.8.13)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}