{"id":"CVE-2026-18836","kind":"vulnerability","aliases":["CVE-2026-18836"],"related":[],"title":"IBM API Connect: server-side request forgery leaks sensitive information remotely","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker can make the server send requests to destinations of their choice and read the responses, which exposes sensitive information.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"IBM API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","ssrf","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"Check your API Connect version. Vulnerable: 10.0.8.0 through 10.0.8.12, and V12 OnPrem 12.1.0.0 through 12.1.1.2. Fixed: 10.0.8.13 and v12.1.1.3. IBM's CVSS vector (AV:N/AC:L/PR:N/UI:N) rates it as needing no credentials.","fix":"Upgrade API Connect 10.0.8.x to 10.0.8.13; upgrade API Connect V12 OnPrem 12.1.x to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds or mitigations.","status":"open","published_at":"2026-11-07T05:18:59+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","triaged_at":"2026-11-07T05:48:34+00:00","updated_at":"2026-11-07T05:50:11+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: server-side request forgery leaks sensitive information remotely","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw. A remote attacker can make the server send requests to destinations of their choice and read the responses, which exposes sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker reads sensitive data from internal systems","analyst_note":"Check IBM's security bulletin for API Connect to confirm the fixed versions, required authentication, and whether the SSRF is reachable without credentials.","how_to_check":"- Check the installed API Connect version against `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges are exposed, since the flaw can be triggered remotely. The sources do not say which deployment paths or configurations make the component reachable, so unknown whether managed or self-hosted deployments differ.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000702,"input_tokens":4250,"output_tokens":554,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for API Connect to confirm the fixed versions, required authentication, and whether the SSRF is reachable without credentials.","search":"'-18836':15A,18A '-2026':14A,17A '10.0.8.0':43B,83C '10.0.8.12':45B,85C '12.1.0.0':47B,87C '12.1.1.2':49B,89C 'affect':107C 'allow':91C 'api':2A,20A,23A,28B,32B,40B,81C 'api-gateway':27B 'attack':60B,94C,124C 'choic':71B 'compon':108C 'connect':3A,21A,24A,33B,41B,82C 'contain':50B 'could':90C 'cve':13A,16A 'destin':68B,117C 'due':99C 'expos':77B 'flaw':57B 'forgeri':8A,56B,105C 'gateway':29B 'host':36B 'ibm':1A,19A,22A,31B,39B,80C 'ibm-api-connect':30B 'inform':11A,79B,98C 'leak':9A 'made':111C 'make':62B 'obtain':96C 'onprem':26A 'read':73B 'remot':12A,59B,93C 'request':7A,55B,66B,104C,114C 'respons':75B,121C 'return':119C 'self':35B 'self-host':34B 'send':65B,113C 'sensit':10A,78B,97C 'server':5A,53B,64B,102C 'server-sid':4A,52B,101C 'side':6A,54B,103C 'ssrf':37B 'unintend':116C 'v12':25A 'vendor':38B 'version':42B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect 10.0.8.0 to 10.0.8.12 or V12 OnPrem 12.1.0.0 to 12.1.1.2 are affected. IBM rates it as remotely reachable with no authentication or user interaction: an attacker can make the server send requests to destinations of their choice and read the responses, exposing sensitive information. Anyone already on 10.0.8.13 or 12.1.1.3 or later can skip it. IBM's bulletins do not say whether the flaw depends on any configuration.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:50:11Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1961},"products":{"at":"2026-11-07T05:50:11Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1961},"workarounds":{"at":"2026-11-07T05:50:11Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1961},"how_to_check":{"at":"2026-11-07T05:50:11Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1961},"who_affected":{"at":"2026-11-07T05:50:11Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1961}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","ibmapiconnect","ibmapiconnectv12onprem"],"ptokens":["api","connect","ibm","onprem","v12"],"labels":["apigateway","critical","ibmapiconnect","selfhosted","ssrf","vendor"],"campaign_type":null,"search_a":"'-18836':15A,18A '-2026':14A,17A 'api':2A,20A,23A 'connect':3A,21A,24A 'cve':13A,16A 'forgeri':8A 'ibm':1A,19A,22A 'inform':11A 'leak':9A 'onprem':26A 'remot':12A 'request':7A 'sensit':10A 'server':5A 'server-sid':4A 'side':6A 'v12':25A","search_b":"'10.0.8.0':43B '10.0.8.12':45B '12.1.0.0':47B '12.1.1.2':49B 'api':28B,32B,40B 'api-gateway':27B 'attack':60B 'choic':71B 'connect':33B,41B 'contain':50B 'destin':68B 'expos':77B 'flaw':57B 'forgeri':56B 'gateway':29B 'host':36B 'ibm':31B,39B 'ibm-api-connect':30B 'inform':79B 'make':62B 'read':73B 'remot':59B 'request':55B,66B 'respons':75B 'self':35B 'self-host':34B 'send':65B 'sensit':78B 'server':53B,64B 'server-sid':52B 'side':54B 'ssrf':37B 'vendor':38B 'version':42B","search_c":"'10.0.8.0':83C '10.0.8.12':85C '12.1.0.0':87C '12.1.1.2':89C 'affect':107C 'allow':91C 'api':81C 'attack':94C,124C 'compon':108C 'connect':82C 'could':90C 'destin':117C 'due':99C 'forgeri':105C 'ibm':80C 'inform':98C 'made':111C 'obtain':96C 'remot':93C 'request':104C,114C 'respons':121C 'return':119C 'send':113C 'sensit':97C 'server':102C 'server-sid':101C 'side':103C 'unintend':116C","first_public_at":"2026-11-07T05:18:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18836","severity":null,"published_at":"2026-11-07T05:18:59+00:00","modified_at":"2026-11-07T05:18:59+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","fetched_at":"2026-11-07T05:46:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-18836:1961","url":"https://www.ibm.com/support/pages/node/7295637","severity":null,"published_at":"2026-11-07T05:50:11+00:00","modified_at":"2026-11-07T05:50:11+00:00","first_seen_at":"2026-11-07T05:50:11+00:00","fetched_at":"2026-11-07T05:50:11+00:00","note":"Read IBM bulletins 7295637 (10.0.8.13) and 7295635 (v12.1.1.3), both list CVE-2026-18836, CWE-918, CVSS 9.3 PR:N; no workarounds. No exploitation or PoC found; did not search social posts.","cites":["https://www.ibm.com/support/pages/node/7295637","https://www.ibm.com/support/pages/node/7295635"]}],"documents":[{"id":93164,"url":"https://www.ibm.com/support/pages/node/7295637","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}