{"id":"CVE-2026-17385","kind":"vulnerability","aliases":["CVE-2026-17385"],"related":[],"title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated attackers","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with an account can make the server issue requests on their behalf and obtain sensitive information.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["unauthenticated-only-exposure","versions-outside-range"],"how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2","fix":"- Move to a release newer than `10.0.8.12` or `12.1.1.2`; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-11-07T05:18:52+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","triaged_at":"2026-11-07T05:50:02+00:00","updated_at":"2026-11-07T05:50:02+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:50:02Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release newer than `10.0.8.12` or `12.1.1.2`; the exact fixed version is unknown from the sources","reach":"internet","title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated attackers","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with an account can make the server issue requests on their behalf and obtain sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker reads sensitive internal information via forged server requests","analyst_note":"Find the IBM security bulletin for CVE-2026-17385 to confirm the fixed version and the vulnerable feature.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-range","unauthenticated-only-exposure"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where users with valid credentials can reach the server. Deployments on versions outside 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are not in the stated range. The sources do not describe the specific feature or endpoint that triggers the forgery.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000748,"input_tokens":4225,"output_tokens":651,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-17385':17A,20A '-2026':16A,19A '10.0.8.0':36B,73C '10.0.8.12':38B,75C '12.1.0.0':40B,77C '12.1.1.2':42B,79C 'account':56B 'allow':81C 'api':2A,22B,26B,33B,71C 'api-gateway':21B 'attack':14A,53B,85C 'authent':13A,84C 'behalf':65B 'connect':3A,27B,34B,72C 'contain':43B 'could':80C 'cve':15A,18A 'due':90C 'flaw':50B 'forgeri':8A,49B,96C 'gateway':23B 'host':31B 'ibm':1A,25B,32B,70C 'ibm-api-connect':24B 'inform':11A,69B,89C 'infrastructur':28B 'issu':61B 'leak':9A 'make':58B 'obtain':67B,87C 'remot':52B,83C 'request':7A,48B,62B,95C 'self':30B 'self-host':29B 'sensit':10A,68B,88C 'server':5A,46B,60B,93C 'server-sid':4A,45B,92C 'side':6A,47B,94C 'version':35B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges, where users with valid credentials can reach the server. Deployments on versions outside 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are not in the stated range. The sources do not describe the specific feature or endpoint that triggers the forgery.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17385':17A,20A '-2026':16A,19A 'api':2A 'attack':14A 'authent':13A 'connect':3A 'cve':15A,18A 'forgeri':8A 'ibm':1A 'inform':11A 'leak':9A 'request':7A 'sensit':10A 'server':5A 'server-sid':4A 'side':6A","search_b":"'10.0.8.0':36B '10.0.8.12':38B '12.1.0.0':40B '12.1.1.2':42B 'account':56B 'api':22B,26B,33B 'api-gateway':21B 'attack':53B 'behalf':65B 'connect':27B,34B 'contain':43B 'flaw':50B 'forgeri':49B 'gateway':23B 'host':31B 'ibm':25B,32B 'ibm-api-connect':24B 'inform':69B 'infrastructur':28B 'issu':61B 'make':58B 'obtain':67B 'remot':52B 'request':48B,62B 'self':30B 'self-host':29B 'sensit':68B 'server':46B,60B 'server-sid':45B 'side':47B 'version':35B","search_c":"'10.0.8.0':73C '10.0.8.12':75C '12.1.0.0':77C '12.1.1.2':79C 'allow':81C 'api':71C 'attack':85C 'authent':84C 'connect':72C 'could':80C 'due':90C 'forgeri':96C 'ibm':70C 'inform':89C 'obtain':87C 'remot':83C 'request':95C 'sensit':88C 'server':93C 'server-sid':92C 'side':94C","first_public_at":"2026-11-07T05:18:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17385","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17385","severity":null,"published_at":"2026-11-07T05:18:52+00:00","modified_at":"2026-11-07T05:18:52+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","fetched_at":"2026-11-07T05:46:06+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}