{"id":"CVE-2026-17384","kind":"vulnerability","aliases":["CVE-2026-17384"],"related":[],"title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests on their behalf and obtain sensitive information.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","auth-required","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["auth-required","outside-version-range"],"how_to_check":"Check your API Connect version; if it is 10.0.8.0 through 10.0.8.12 you are affected. Fixed in 10.0.8.13.","fix":"Upgrade IBM API Connect to 10.0.8.13 (IBM Fix Central)","status":"open","published_at":"2026-11-07T05:18:52+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","triaged_at":"2026-11-07T05:50:00+00:00","updated_at":"2026-11-07T06:08:52+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-07T05:50:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests on their behalf and obtain sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads sensitive information from internal server requests","analyst_note":"Check IBM's security bulletin for CVE-2026-17384 for the fixed version and affected features; the sources given only state the range.","how_to_check":"- Confirm the installed version of IBM API Connect is in the range 10.0.8.0 through 10.0.8.12\n- Check the product's admin or version page for the build number\n- unknown otherwise","plain_action":"","needs_analyst":true,"not_affected_if":["outside-version-range"],"who_is_affected":"Organizations running IBM API Connect 10.0.8.0 through 10.0.8.12 where users can authenticate to the platform. The sources do not say which deployment modes or features are required to reach the vulnerable request path. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":4199,"output_tokens":519,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for CVE-2026-17384 for the fixed version and affected features; the sources given only state the range.","search":"'-17384':17A,20A '-2026':16A,19A '10.0.8.0':42B,76C '10.0.8.12':44B,78C 'account':59B 'allow':80C 'api':2A,22A,25B,32B,39B,74C 'api-gateway':24B 'attack':55B,84C 'auth':28B 'auth-requir':27B 'authent':13A,83C 'behalf':68B 'connect':3A,23A,33B,40B,75C 'contain':45B 'could':79C 'cve':15A,18A 'due':89C 'flaw':52B 'forgeri':8A,51B,96C 'gateway':26B 'host':37B 'ibm':1A,21A,31B,38B,73C 'ibm-api-connect':30B 'inform':11A,72B,88C 'infrastructur':34B 'leak':9A 'make':61B 'obtain':70B,86C 'remot':54B,82C 'request':7A,50B,65B,95C 'requir':29B 'self':36B 'self-host':35B 'send':64B 'sensit':10A,71B,87C 'server':5A,48B,63B,93C 'server-sid':4A,47B,92C 'side':6A,49B,94C 'user':14A 'valid':58B 'version':41B 'vulner':97C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect 10.0.8.0 through 10.0.8.12 where users can authenticate to the platform. The sources do not say which deployment modes or features are required to reach the vulnerable request path. unknown","tier":"B","verified":{"fix":{"at":"2026-11-07T06:08:52Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2013}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apiconnect","ibmapiconnect"],"ptokens":["api","connect","ibm"],"labels":["apigateway","authrequired","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17384':17A,20A '-2026':16A,19A 'api':2A,22A 'authent':13A 'connect':3A,23A 'cve':15A,18A 'forgeri':8A 'ibm':1A,21A 'inform':11A 'leak':9A 'request':7A 'sensit':10A 'server':5A 'server-sid':4A 'side':6A 'user':14A","search_b":"'10.0.8.0':42B '10.0.8.12':44B 'account':59B 'api':25B,32B,39B 'api-gateway':24B 'attack':55B 'auth':28B 'auth-requir':27B 'behalf':68B 'connect':33B,40B 'contain':45B 'flaw':52B 'forgeri':51B 'gateway':26B 'host':37B 'ibm':31B,38B 'ibm-api-connect':30B 'inform':72B 'infrastructur':34B 'make':61B 'obtain':70B 'remot':54B 'request':50B,65B 'requir':29B 'self':36B 'self-host':35B 'send':64B 'sensit':71B 'server':48B,63B 'server-sid':47B 'side':49B 'valid':58B 'version':41B","search_c":"'10.0.8.0':76C '10.0.8.12':78C 'allow':80C 'api':74C 'attack':84C 'authent':83C 'connect':75C 'could':79C 'due':89C 'forgeri':96C 'ibm':73C 'inform':88C 'obtain':86C 'remot':82C 'request':95C 'sensit':87C 'server':93C 'server-sid':92C 'side':94C 'vulner':97C","first_public_at":"2026-11-07T05:18:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17384","severity":null,"published_at":"2026-11-07T05:18:52+00:00","modified_at":"2026-11-07T05:18:52+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","fetched_at":"2026-11-07T05:46:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17384:2013","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:08:52+00:00","modified_at":"2026-11-07T06:08:52+00:00","first_seen_at":"2026-11-07T06:08:52+00:00","fetched_at":"2026-11-07T06:08:52+00:00","note":"IBM bulletin (security-bulletin-multiple-vulnerabilities-ibm-api-connect-41) lists this CVE as fixed in API Connect 10.0.8.13; affected range 10.0.8.0-10.0.8.12 from NVD (bulletin text I got was truncated before its affected-versions table). Specific feature/endpoint not stated by IBM. No exploitation or PoC found.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://nvd.nist.gov/vuln/detail/CVE-2026-17384"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93260,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17384","title":"NVD CVE-2026-17384","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}