{"id":"CVE-2026-17404","kind":"vulnerability","aliases":["CVE-2026-17404"],"related":[],"title":"IBM API Connect: authenticated attacker can obtain sensitive data via request forgery","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have a server-side request forgery flaw. A remote attacker with a valid account can make the server fetch internal resources and leak sensitive information.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["10.0.8.13","12.1.1.3"],"affected":">= 10.0.8.0, <= 10.0.8.12; >= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["fixed-version-installed","version-outside-range"],"how_to_check":"Find your API Connect version (e.g. apic version, or the version shown in the API Manager/Cloud Manager). Exposed if it is 10.0.8.0 through 10.0.8.12 or 12.1.0.0 through 12.1.1.2. Fixed in 10.0.8.13 and 12.1.1.3.","fix":"Upgrade to API Connect 12.1.1.3 (12.1.x) or 10.0.8.13 (10.0.8.x); IBM Fix Central.","status":"open","published_at":"2026-11-07T05:18:56+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","triaged_at":"2026-11-07T05:48:55+00:00","updated_at":"2026-11-07T06:05:45+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-07T05:48:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: authenticated attacker can obtain sensitive data via request forgery","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have a server-side request forgery flaw. A remote attacker with a valid account can make the server fetch internal resources and leak sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker reads sensitive information from internal server resources","analyst_note":"Confirm the affected feature, any fixed version and IBM's advisory text, since the NVD entry gives only the description and ranges.","how_to_check":"- Check the installed API Connect version against the affected ranges, 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks, the sources do not say which feature or endpoint is involved.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where remote users hold accounts. The sources do not say which endpoints or configurations are involved, so teams should confirm against IBM's advisory. Deployments on versions outside the listed ranges are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000708,"input_tokens":4225,"output_tokens":571,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected feature, any fixed version and IBM's advisory text, since the NVD entry gives only the description and ranges.","search":"'-17404':15A,18A '-2026':14A,17A '10.0.8.0':34B,70C '10.0.8.12':36B,72C '12.1.0.0':38B,74C '12.1.1.2':40B,76C 'account':55B 'allow':78C 'api':2A,20A,24B,31B,68C 'api-connect':19A 'attack':5A,51B,82C 'authent':4A,81C 'connect':3A,21A,25B,32B,69C 'could':77C 'cve':13A,16A 'data':9A 'due':87C 'fetch':60B 'flaw':48B 'forgeri':12A,47B,93C 'host':29B 'ibm':1A,23B,30B,67C 'ibm-api-connect':22B 'inform':66B,86C 'infrastructur':26B 'intern':61B 'leak':64B 'make':57B 'obtain':7A,84C 'remot':50B,80C 'request':11A,46B,92C 'resourc':62B 'self':28B 'self-host':27B 'sensit':8A,65B,85C 'server':44B,59B,90C 'server-sid':43B,89C 'side':45B,91C 'valid':54B 'version':33B 'via':10A","nicknames":[],"mitigations":[],"who_affected":"Self-managed IBM API Connect deployments on 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2. An attacker needs a valid account (low privileges) and can make the server send requests to internal resources and read back sensitive information. IBM's CVE text does not name the endpoint or feature. Deployments already on 10.0.8.13 or 12.1.1.3 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect"],"ptokens":["api","connect"],"labels":["high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17404':15A,18A '-2026':14A,17A 'api':2A,20A 'api-connect':19A 'attack':5A 'authent':4A 'connect':3A,21A 'cve':13A,16A 'data':9A 'forgeri':12A 'ibm':1A 'obtain':7A 'request':11A 'sensit':8A 'via':10A","search_b":"'10.0.8.0':34B '10.0.8.12':36B '12.1.0.0':38B '12.1.1.2':40B 'account':55B 'api':24B,31B 'attack':51B 'connect':25B,32B 'fetch':60B 'flaw':48B 'forgeri':47B 'host':29B 'ibm':23B,30B 'ibm-api-connect':22B 'inform':66B 'infrastructur':26B 'intern':61B 'leak':64B 'make':57B 'remot':50B 'request':46B 'resourc':62B 'self':28B 'self-host':27B 'sensit':65B 'server':44B,59B 'server-sid':43B 'side':45B 'valid':54B 'version':33B","search_c":"'10.0.8.0':70C '10.0.8.12':72C '12.1.0.0':74C '12.1.1.2':76C 'allow':78C 'api':68C 'attack':82C 'authent':81C 'connect':69C 'could':77C 'due':87C 'forgeri':93C 'ibm':67C 'inform':86C 'obtain':84C 'remot':80C 'request':92C 'sensit':85C 'server':90C 'server-sid':89C 'side':91C","first_public_at":"2026-11-07T05:18:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17404","severity":null,"published_at":"2026-11-07T05:18:56+00:00","modified_at":"2026-11-07T05:18:57+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","fetched_at":"2026-11-07T05:46:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17404:2006","url":"https://www.ibm.com/support/pages/node/7295635","severity":null,"published_at":"2026-11-07T06:05:45+00:00","modified_at":"2026-11-07T06:05:45+00:00","first_seen_at":"2026-11-07T06:05:45+00:00","fetched_at":"2026-11-07T06:05:45+00:00","note":"IBM bulletins nodes 7295635 (12.1.1.3) and 7295637 (10.0.8.13), listed as references on the CVE record with IBM's fix text. Fetched bulletin text was truncated before this CVE's entry, so I did not mark fields verified. Affected feature not stated by IBM. No exploitation or PoC found.","cites":["https://www.ibm.com/support/pages/node/7295635","https://www.ibm.com/support/pages/node/7295637","https://app.opencve.io/cve/CVE-2026-17404"]}],"documents":[{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93164,"url":"https://www.ibm.com/support/pages/node/7295637","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93242,"url":"https://app.opencve.io/cve/CVE-2026-17404","title":"OpenCVE CVE-2026-17404 (carries IBM's solution text)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}