{"id":"CVE-2026-17368","kind":"vulnerability","aliases":["CVE-2026-17368"],"related":[],"title":"IBM API Connect: authenticated SSRF lets attackers scan networks and steal credentials","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform network reconnaissance and obtain sensitive credentials due to server-side request forgery. The server can be made to send requests to unintended destinations and return the results.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A logged-in attacker can make the server send requests to unintended destinations and return the results, exposing internal network details and sensitive credentials.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["no-authenticated-users","other-versions"],"how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.","fix":null,"status":"open","published_at":"2026-11-07T05:18:49+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","triaged_at":"2026-11-07T05:52:23+00:00","updated_at":"2026-11-07T05:52:23+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:52:23Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not state a fixed version.","reach":"network","title":"IBM API Connect: authenticated SSRF lets attackers scan networks and steal credentials","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A logged-in attacker can make the server send requests to unintended destinations and return the results, exposing internal network details and sensitive credentials.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"internal network mapped and sensitive credentials exposed to attacker","analyst_note":"Find the IBM security bulletin for CVE-2026-17368 to confirm the fixed versions and any required configuration.","how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks; the sources do not say which setting or endpoint is involved.","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions","no-authenticated-users"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges. The attacker needs a valid account on the platform, so exposure depends on who can log in and how widely accounts are issued. unknown whether a non-default configuration is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4259,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17368':15A,18A '-2026':14A,17A '10.0.8.0':34B,77C '10.0.8.12':36B,79C '12.1.0.0':38B,81C '12.1.1.2':40B,83C 'allow':85C 'api':2A,20B,24B,31B,75C 'api-gateway':19B 'attack':7A,53B,89C 'authent':4A,88C 'connect':3A,25B,32B,76C 'contain':41B 'could':84C 'credenti':12A,73B,97C 'cve':13A,16A 'destin':62B,115C 'detail':70B 'due':98C 'expos':67B 'flaw':48B 'forgeri':47B,104C 'gateway':21B 'host':29B 'ibm':1A,23B,30B,74C 'ibm-api-connect':22B 'infrastructur':26B 'intern':68B 'let':6A 'log':51B 'logged-in':50B 'made':109C 'make':55B 'network':9A,69B,92C 'obtain':95C 'perform':91C 'reconnaiss':93C 'remot':87C 'request':46B,59B,103C,112C 'result':66B,119C 'return':64B,117C 'scan':8A 'self':28B 'self-host':27B 'send':58B,111C 'sensit':72B,96C 'server':44B,57B,101C,106C 'server-sid':43B,100C 'side':45B,102C 'ssrf':5A 'steal':11A 'unintend':61B,114C 'version':33B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges. The attacker needs a valid account on the platform, so exposure depends on who can log in and how widely accounts are issued. unknown whether a non-default configuration is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-17368':15A,18A '-2026':14A,17A 'api':2A 'attack':7A 'authent':4A 'connect':3A 'credenti':12A 'cve':13A,16A 'ibm':1A 'let':6A 'network':9A 'scan':8A 'ssrf':5A 'steal':11A","search_b":"'10.0.8.0':34B '10.0.8.12':36B '12.1.0.0':38B '12.1.1.2':40B 'api':20B,24B,31B 'api-gateway':19B 'attack':53B 'connect':25B,32B 'contain':41B 'credenti':73B 'destin':62B 'detail':70B 'expos':67B 'flaw':48B 'forgeri':47B 'gateway':21B 'host':29B 'ibm':23B,30B 'ibm-api-connect':22B 'infrastructur':26B 'intern':68B 'log':51B 'logged-in':50B 'make':55B 'network':69B 'request':46B,59B 'result':66B 'return':64B 'self':28B 'self-host':27B 'send':58B 'sensit':72B 'server':44B,57B 'server-sid':43B 'side':45B 'unintend':61B 'version':33B","search_c":"'10.0.8.0':77C '10.0.8.12':79C '12.1.0.0':81C '12.1.1.2':83C 'allow':85C 'api':75C 'attack':89C 'authent':88C 'connect':76C 'could':84C 'credenti':97C 'destin':115C 'due':98C 'forgeri':104C 'ibm':74C 'made':109C 'network':92C 'obtain':95C 'perform':91C 'reconnaiss':93C 'remot':87C 'request':103C,112C 'result':119C 'return':117C 'send':111C 'sensit':96C 'server':101C,106C 'server-sid':100C 'side':102C 'unintend':114C","first_public_at":"2026-11-07T05:18:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17368","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17368","severity":null,"published_at":"2026-11-07T05:18:49+00:00","modified_at":"2026-11-07T05:18:49+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","fetched_at":"2026-11-07T05:46:05+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}