{"id":"CVE-2026-17372","kind":"vulnerability","aliases":["CVE-2026-17372"],"related":[],"title":"IBM API Connect: webhook URLs let authenticated users probe internal networks","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to probe internal network resources due to insufficient validation of webhook destination URLs. User-configured webhook addresses are not sufficiently restricted, so the server could be made to contact internal systems.","summary":"IBM API Connect does not sufficiently restrict user-configured webhook destination URLs, so the server can be made to send requests to internal systems. A remote attacker with a valid account can use this to probe internal network resources.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.","fix":null,"status":"open","published_at":"2026-11-07T05:18:50+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","triaged_at":"2026-11-07T05:52:38+00:00","updated_at":"2026-11-07T05:52:38+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:52:38Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed release; the sources do not name the fixed version. Check IBM's security bulletin for the version.","reach":"network","title":"IBM API Connect: webhook URLs let authenticated users probe internal networks","impact":"low","summary":"IBM API Connect does not sufficiently restrict user-configured webhook destination URLs, so the server can be made to send requests to internal systems. A remote attacker with a valid account can use this to probe internal network resources.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker maps internal services via server-side requests to internal addresses.","analyst_note":"Find IBM's security bulletin for CVE-2026-17372 to confirm the fixed version and whether webhooks are enabled by default.","how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks; the sources do not say how to confirm webhook configuration exposure.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running IBM API Connect in the affected 10.0.8.x or 12.1.x ranges where users can configure webhooks. The sources do not say whether default configurations are affected. Deployments on other versions are not in the stated ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000714,"input_tokens":4268,"output_tokens":574,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17372':14A,17A '-2026':13A,16A '10.0.8.0':69C '10.0.8.12':71C '12.1.0.0':73C '12.1.1.2':75C 'account':57B 'address':99C 'allow':77C 'api':2A,20B,27B,67C 'attack':53B,81C 'authent':7A,80C 'configur':35B,97C 'connect':3A,21B,28B,68C 'contact':111C 'could':76C,107C 'cve':12A,15A 'destin':37B,93C 'due':87C 'host':25B 'ibm':1A,19B,26B,66C 'ibm-api-connect':18B 'infrastructur':22B 'insuffici':89C 'intern':10A,49B,63B,84C,112C 'let':6A 'made':44B,109C 'network':11A,64B,85C 'probe':9A,62B,83C 'remot':52B,79C 'request':47B 'resourc':65B,86C 'restrict':32B,103C 'self':24B 'self-host':23B 'send':46B 'server':41B,106C 'suffici':31B,102C 'system':50B,113C 'url':5A,38B,94C 'use':59B 'user':8A,34B,96C 'user-configur':33B,95C 'valid':56B,90C 'webhook':4A,36B,92C,98C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect in the affected 10.0.8.x or 12.1.x ranges where users can configure webhooks. The sources do not say whether default configurations are affected. Deployments on other versions are not in the stated ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmapiconnect","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-17372':14A,17A '-2026':13A,16A 'api':2A 'authent':7A 'connect':3A 'cve':12A,15A 'ibm':1A 'intern':10A 'let':6A 'network':11A 'probe':9A 'url':5A 'user':8A 'webhook':4A","search_b":"'account':57B 'api':20B,27B 'attack':53B 'configur':35B 'connect':21B,28B 'destin':37B 'host':25B 'ibm':19B,26B 'ibm-api-connect':18B 'infrastructur':22B 'intern':49B,63B 'made':44B 'network':64B 'probe':62B 'remot':52B 'request':47B 'resourc':65B 'restrict':32B 'self':24B 'self-host':23B 'send':46B 'server':41B 'suffici':31B 'system':50B 'url':38B 'use':59B 'user':34B 'user-configur':33B 'valid':56B 'webhook':36B","search_c":"'10.0.8.0':69C '10.0.8.12':71C '12.1.0.0':73C '12.1.1.2':75C 'address':99C 'allow':77C 'api':67C 'attack':81C 'authent':80C 'configur':97C 'connect':68C 'contact':111C 'could':76C,107C 'destin':93C 'due':87C 'ibm':66C 'insuffici':89C 'intern':84C,112C 'made':109C 'network':85C 'probe':83C 'remot':79C 'resourc':86C 'restrict':103C 'server':106C 'suffici':102C 'system':113C 'url':94C 'user':96C 'user-configur':95C 'valid':90C 'webhook':92C,98C","first_public_at":"2026-11-07T05:18:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17372","severity":null,"published_at":"2026-11-07T05:18:50+00:00","modified_at":"2026-11-07T05:18:50+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","fetched_at":"2026-11-07T05:46:06+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}