{"id":"CVE-2026-17397","kind":"vulnerability","aliases":["CVE-2026-17397"],"related":[],"title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests it should not, and read sensitive information in return.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"api-connect-v12-onprem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","ibm-api-connect","self-hosted","ssrf","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"Check your API Connect version. Affected: 10.0.8.0 through 10.0.8.12, and 12.1.0.0 through 12.1.1.2 (IBM lists the V12 OnPrem product). Fixed in 10.0.8.13 and 12.1.1.3.","fix":"Upgrade API Connect 12.1.x to 12.1.1.3 (IBM Fix Central: https://www.ibm.com/support/pages/node/7290205); upgrade 10.0.8.x to 10.0.8.13. IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:55+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","triaged_at":"2026-11-07T05:48:58+00:00","updated_at":"2026-11-07T06:06:51+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests it should not, and read sensitive information in return.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Sensitive information readable by an authenticated remote attacker","analyst_note":"Find the IBM security bulletin for CVE-2026-17397 to confirm the fixed version and any configuration that matters.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Teams running IBM API Connect in the affected version ranges. The sources do not say which deployment settings or roles make an instance more exposed, so unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4225,"output_tokens":506,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-17397 to confirm the fixed version and any configuration that matters.","search":"'-17397':17A,20A '-2026':16A,19A '10.0.8.0':43B,83C '10.0.8.12':45B,85C '12.1.0.0':47B,87C '12.1.1.2':49B,89C 'account':64B 'allow':91C 'api':2A,22A,25A,32B,40B,81C 'api-connect':21A 'api-connect-v12-onprem':24A 'attack':60B,95C 'authent':13A,29B,94C 'connect':3A,23A,26A,33B,41B,82C 'contain':50B 'could':90C 'cve':15A,18A 'due':100C 'flaw':57B 'forgeri':8A,56B,106C 'host':36B 'ibm':1A,31B,39B,80C 'ibm-api-connect':30B 'inform':11A,77B,99C 'leak':9A 'make':66B 'obtain':97C 'onprem':28A 'read':75B 'remot':59B,93C 'request':7A,55B,70B,105C 'return':79B 'self':35B 'self-host':34B 'send':69B 'sensit':10A,76B,98C 'server':5A,53B,68B,103C 'server-sid':4A,52B,102C 'side':6A,54B,104C 'ssrf':37B 'user':14A 'v12':27A 'valid':63B 'vendor':38B 'version':42B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2. An attacker needs a valid account, then can make the server send requests and read sensitive information in the response. IBM states no settings that change exposure; instances already on 10.0.8.13 or 12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:06:51Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2010},"products":{"at":"2026-11-07T06:06:51Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2010},"mitigations":{"at":"2026-11-07T06:06:51Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2010},"workarounds":{"at":"2026-11-07T06:06:51Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2010},"how_to_check":{"at":"2026-11-07T06:06:51Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2010},"who_affected":{"at":"2026-11-07T06:06:51Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2010}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["authenticated","high","ibmapiconnect","selfhosted","ssrf","vendor"],"campaign_type":null,"search_a":"'-17397':17A,20A '-2026':16A,19A 'api':2A,22A,25A 'api-connect':21A 'api-connect-v12-onprem':24A 'authent':13A 'connect':3A,23A,26A 'cve':15A,18A 'forgeri':8A 'ibm':1A 'inform':11A 'leak':9A 'onprem':28A 'request':7A 'sensit':10A 'server':5A 'server-sid':4A 'side':6A 'user':14A 'v12':27A","search_b":"'10.0.8.0':43B '10.0.8.12':45B '12.1.0.0':47B '12.1.1.2':49B 'account':64B 'api':32B,40B 'attack':60B 'authent':29B 'connect':33B,41B 'contain':50B 'flaw':57B 'forgeri':56B 'host':36B 'ibm':31B,39B 'ibm-api-connect':30B 'inform':77B 'make':66B 'read':75B 'remot':59B 'request':55B,70B 'return':79B 'self':35B 'self-host':34B 'send':69B 'sensit':76B 'server':53B,68B 'server-sid':52B 'side':54B 'ssrf':37B 'valid':63B 'vendor':38B 'version':42B","search_c":"'10.0.8.0':83C '10.0.8.12':85C '12.1.0.0':87C '12.1.1.2':89C 'allow':91C 'api':81C 'attack':95C 'authent':94C 'connect':82C 'could':90C 'due':100C 'forgeri':106C 'ibm':80C 'inform':99C 'obtain':97C 'remot':93C 'request':105C 'sensit':98C 'server':103C 'server-sid':102C 'side':104C","first_public_at":"2026-11-07T05:18:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17397","severity":null,"published_at":"2026-11-07T05:18:55+00:00","modified_at":"2026-11-07T05:18:55+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","fetched_at":"2026-11-07T05:46:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17397:2010","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:06:51+00:00","modified_at":"2026-11-07T06:06:51+00:00","first_seen_at":"2026-11-07T06:06:51+00:00","fetched_at":"2026-11-07T06:06:51+00:00","note":"Found in two IBM bulletins (v12.1.1.3 and 10.0.8.13); both list CVE-2026-17397, workarounds None. No config condition stated; no exploitation or PoC seen.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}