{"id":"CVE-2026-17398","kind":"vulnerability","aliases":["CVE-2026-17398"],"related":[],"title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests on their behalf and read sensitive information in return.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13","12.1.1.3"],"affected":">= 10.0.8.0, <= 10.0.8.12 || >= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","authenticated","ibm-api-connect","infrastructure","self-hosted","ssrf"],"not_affected_if":["unknown","version-outside-affected-ranges"],"how_to_check":"Check the installed API Connect version. Affected: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 (self-managed / on-prem). Fixed: 10.0.8.13 and 12.1.1.3. IBM names no required setting.","fix":"Upgrade API Connect V12 to 12.1.1.3 (https://www.ibm.com/support/pages/node/7290205), or the 10.0.8 line to 10.0.8.13 (per the CVE record's solution text; not yet confirmed on the IBM bulletin page).","status":"open","published_at":"2026-11-07T05:18:55+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","triaged_at":"2026-11-07T05:48:58+00:00","updated_at":"2026-11-07T06:06:45+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-07T05:48:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: server-side request forgery leaks sensitive information to authenticated users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker with a valid account can make the server send requests on their behalf and read sensitive information in return.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Sensitive information from internal systems is readable by the attacker","analyst_note":"Find the IBM security bulletin for CVE-2026-17398 to confirm the fixed versions and any required configuration.","how_to_check":"- Check the installed API Connect version against the affected ranges: `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2`.\n- unknown for other checks: the sources do not say which configuration or feature is required.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where remote users hold authenticated accounts. The sources do not say which features or configurations make the flaw reachable, and do not name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000695,"input_tokens":4225,"output_tokens":544,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-17398 to confirm the fixed versions and any required configuration.","search":"'-17398':17A,20A '-2026':16A,19A '10.0.8.0':40B,80C '10.0.8.12':42B,82C '12.1.0.0':44B,84C '12.1.1.2':46B,86C 'account':61B 'allow':88C 'api':2A,21A,24B,29B,37B,78C 'api-gateway':23B 'attack':57B,92C 'authent':13A,26B,91C 'behalf':70B 'connect':3A,22A,30B,38B,79C 'contain':47B 'could':87C 'cve':15A,18A 'due':97C 'flaw':54B 'forgeri':8A,53B,103C 'gateway':25B 'host':34B 'ibm':1A,28B,36B,77C 'ibm-api-connect':27B 'inform':11A,74B,96C 'infrastructur':31B 'leak':9A 'make':63B 'obtain':94C 'read':72B 'remot':56B,90C 'request':7A,52B,67B,102C 'return':76B 'self':33B 'self-host':32B 'send':66B 'sensit':10A,73B,95C 'server':5A,50B,65B,100C 'server-sid':4A,49B,99C 'side':6A,51B,101C 'ssrf':35B 'user':14A 'valid':60B 'version':39B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges, where remote users hold authenticated accounts. The sources do not say which features or configurations make the flaw reachable, and do not name a fixed version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apiconnect","connect"],"ptokens":["api","connect"],"labels":["apigateway","authenticated","high","ibmapiconnect","infrastructure","selfhosted","ssrf"],"campaign_type":null,"search_a":"'-17398':17A,20A '-2026':16A,19A 'api':2A,21A 'authent':13A 'connect':3A,22A 'cve':15A,18A 'forgeri':8A 'ibm':1A 'inform':11A 'leak':9A 'request':7A 'sensit':10A 'server':5A 'server-sid':4A 'side':6A 'user':14A","search_b":"'10.0.8.0':40B '10.0.8.12':42B '12.1.0.0':44B '12.1.1.2':46B 'account':61B 'api':24B,29B,37B 'api-gateway':23B 'attack':57B 'authent':26B 'behalf':70B 'connect':30B,38B 'contain':47B 'flaw':54B 'forgeri':53B 'gateway':25B 'host':34B 'ibm':28B,36B 'ibm-api-connect':27B 'inform':74B 'infrastructur':31B 'make':63B 'read':72B 'remot':56B 'request':52B,67B 'return':76B 'self':33B 'self-host':32B 'send':66B 'sensit':73B 'server':50B,65B 'server-sid':49B 'side':51B 'ssrf':35B 'valid':60B 'version':39B","search_c":"'10.0.8.0':80C '10.0.8.12':82C '12.1.0.0':84C '12.1.1.2':86C 'allow':88C 'api':78C 'attack':92C 'authent':91C 'connect':79C 'could':87C 'due':97C 'forgeri':103C 'ibm':77C 'inform':96C 'obtain':94C 'remot':90C 'request':102C 'sensit':95C 'server':100C 'server-sid':99C 'side':101C","first_public_at":"2026-11-07T05:18:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17398","severity":null,"published_at":"2026-11-07T05:18:55+00:00","modified_at":"2026-11-07T05:18:55+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","fetched_at":"2026-11-07T05:46:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17398:2009","url":"https://app.opencve.io/cve/CVE-2026-17398","severity":null,"published_at":"2026-11-07T06:06:45+00:00","modified_at":"2026-11-07T06:06:45+00:00","first_seen_at":"2026-11-07T06:06:45+00:00","fetched_at":"2026-11-07T06:06:45+00:00","note":"IBM CNA record (via OpenCVE) gives fix: 12.1.1.3 and 10.0.8.13, CVSS 8.5 (PR:L, S:C). IBM bulletins -39 (V12) and -41 / node 7295637 (10.0.8) could only be read truncated; CVE-2026-17398 not seen in the visible text, so nothing marked verified. No component or setting named. Release page node/7290205 does not mention this CVE. Confirm on the full IBM bulletin.","cites":["https://app.opencve.io/cve/CVE-2026-17398","https://www.ibm.com/support/pages/node/7290205"]}],"documents":[{"id":93247,"url":"https://app.opencve.io/cve/CVE-2026-17398","title":"OpenCVE: CVE-2026-17398 (CNA record with IBM solution text)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":93155,"url":"https://www.ibm.com/support/pages/node/7290205","title":"IBM API Connect v12.1.1.3 is now available","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}