---
id: "CVE-2026-17365"
page: "https://infrastack.ai/live/CVE-2026-17365"
kind: "vulnerability"
aliases: ["CVE-2026-17365"]
title: "IBM API Connect: server-side request forgery leaks sensitive information to authenticated users"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "api-connect", "fixed": ["10.0.8.13"], "affected": ">= 10.0.8.0, <= 10.0.8.12", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ibm-api-connect", "self-hosted", "vendor"]
not_affected_if: ["unaffected-version"]
published_at: "2026-11-07T05:18:48+00:00"
first_seen_at: "2026-11-07T05:46:05+00:00"
updated_at: "2026-11-07T06:11:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17365", "first_seen_at": "2026-11-07T05:46:05+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/node/7295637", "first_seen_at": "2026-11-07T06:11:23+00:00", "cites": ["https://www.ibm.com/support/pages/node/7295637", "https://app.opencve.io/cve/CVE-2026-17365"]}]
exploit_sources: []
---

# IBM API Connect: server-side request forgery leaks sensitive information to authenticated users

Link for people: https://infrastack.ai/live/CVE-2026-17365 (this .md is for agents)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests to internal targets and obtain sensitive information.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:api-connect affected >= 10.0.8.0, <= 10.0.8.12 fixed 10.0.8.13

## How to check

Check your API Connect version. Per IBM, affected is 10.0.8.0 to 10.0.8.12 (fixed in 10.0.8.13). The CVE record also lists 12.1.0.0 to 12.1.1.2, but IBM's bulletin names only the 10.0.8 stream. Any account on the instance that can submit URLs is a potential attacker, so review who holds accounts.

## Fix

API Connect 10.0.8.x: upgrade to 10.0.8.13 (IBM bulletin node/7295637). 12.1.x: the CVE record (via OpenCVE) says upgrade to v12.1.1.3, but the v12.1.1.3 bulletin I read does not list this CVE; confirm with IBM before relying on it.

## Timeline

- 2026-11-07T05:46:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17365
- 2026-11-07T06:11:23+00:00 analyst https://www.ibm.com/support/pages/node/7295637 — IBM bulletin node/7295637 lists CVE-2026-17365 (CVSS 8.5), affects 10.0.8.0-10.0.8.12, fix 10.0.8.13, workaround none. 12.1.x range and 12.1.1.3 fix come only from the CVE record; the 12.1.1.3 bulletin (-37) did not list this CVE in what I read, so left unverified. No exploitation or PoC found.

## Documents

- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13) https://www.ibm.com/support/pages/node/7295637
- [mentions] OpenCVE CVE-2026-17365 (CNA record: fix 12.1.1.3 / 10.0.8.13) https://app.opencve.io/cve/CVE-2026-17365

## From the sources

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_