{"id":"CVE-2026-19128","kind":"vulnerability","aliases":["CVE-2026-19128"],"related":[],"title":"IBM API Connect: authenticated users can send server-side forged requests","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 have a server-side request forgery flaw. An authenticated attacker can make the server send requests to internal network resources, which can be used to map the network or support further attacks.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted","ssrf"],"not_affected_if":["versions-outside-range"],"how_to_check":"Check your IBM API Connect version. Affected: 12.1.0.0 through 12.1.1.2. Fixed: 12.1.1.3. The 10.0.8.x line is not listed in this CVE's range. Note that IBM's CVSS vector (AV:N/PR:N, 7.5, confidentiality impact only) suggests no login may be needed, though the text says authenticated.","fix":"Upgrade IBM API Connect to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205).","status":"open","published_at":"2026-11-07T05:19:00+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","triaged_at":"2026-11-07T05:52:05+00:00","updated_at":"2026-11-07T06:03:31+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-07T05:52:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can send server-side forged requests","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 have a server-side request forgery flaw. An authenticated attacker can make the server send requests to internal network resources, which can be used to map the network or support further attacks.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker maps internal network resources via the server.","analyst_note":"Confirm the fixed version and any vendor advisory from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-19128); the sources give no fix or check details.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-range"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where users hold valid accounts. The sources do not describe specific configurations or features that make a deployment more exposed. unknown for remaining details.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4214,"output_tokens":524,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any vendor advisory from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-19128); the sources give no fix or check details.","search":"'-19128':15A,18A '-2026':14A,17A '12.1.0.0':38B,77C '12.1.1.2':40B,79C 'allow':81C 'api':2A,20A,23B,27B,35B,75C 'api-connect':19A 'api-gateway':22B 'attack':51B,73B,84C,111C 'authent':4A,50B,83C 'connect':3A,21A,28B,36B,76C 'could':80C,100C 'cve':13A,16A 'due':92C 'enumer':104C 'flaw':48B 'forg':11A 'forgeri':47B,98C 'gateway':24B 'host':32B 'ibm':1A,26B,34B,74C 'ibm-api-connect':25B 'infrastructur':29B 'intern':59B 'make':53B 'map':67B 'network':60B,69B,105C 'request':12A,46B,57B,88C,97C 'resourc':61B,106C 'self':31B 'self-host':30B 'send':7A,56B,86C 'server':9A,44B,55B,95C 'server-sid':8A,43B,94C 'side':10A,45B,96C 'ssrf':33B 'support':71B,109C 'system':91C 'unauthor':87C 'use':65B,102C 'user':5A 'version':37B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect 12.1.0.0 through 12.1.1.2, which IBM ships as software you run yourself (OVA/containers). The server can be made to send requests from the system to internal network resources, which lets an attacker map the network or prepare further attacks. IBM's text says an authenticated attacker, but its CVSS vector says no login is needed, so treat reachable installs as exposed. Anyone on 12.1.1.3 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect"],"ptokens":["api","connect"],"labels":["apigateway","high","ibmapiconnect","infrastructure","selfhosted","ssrf"],"campaign_type":null,"search_a":"'-19128':15A,18A '-2026':14A,17A 'api':2A,20A 'api-connect':19A 'authent':4A 'connect':3A,21A 'cve':13A,16A 'forg':11A 'ibm':1A 'request':12A 'send':7A 'server':9A 'server-sid':8A 'side':10A 'user':5A","search_b":"'12.1.0.0':38B '12.1.1.2':40B 'api':23B,27B,35B 'api-gateway':22B 'attack':51B,73B 'authent':50B 'connect':28B,36B 'flaw':48B 'forgeri':47B 'gateway':24B 'host':32B 'ibm':26B,34B 'ibm-api-connect':25B 'infrastructur':29B 'intern':59B 'make':53B 'map':67B 'network':60B,69B 'request':46B,57B 'resourc':61B 'self':31B 'self-host':30B 'send':56B 'server':44B,55B 'server-sid':43B 'side':45B 'ssrf':33B 'support':71B 'use':65B 'version':37B","search_c":"'12.1.0.0':77C '12.1.1.2':79C 'allow':81C 'api':75C 'attack':84C,111C 'authent':83C 'connect':76C 'could':80C,100C 'due':92C 'enumer':104C 'forgeri':98C 'ibm':74C 'network':105C 'request':88C,97C 'resourc':106C 'send':86C 'server':95C 'server-sid':94C 'side':96C 'support':109C 'system':91C 'unauthor':87C 'use':102C","first_public_at":"2026-11-07T05:19:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19128","severity":null,"published_at":"2026-11-07T05:19:00+00:00","modified_at":"2026-11-07T05:19:00+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","fetched_at":"2026-11-07T05:46:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-19128:2001","url":"https://www.ibm.com/support/pages/node/7295635","severity":null,"published_at":"2026-11-07T06:03:31+00:00","modified_at":"2026-11-07T06:03:31+00:00","first_seen_at":"2026-11-07T06:03:31+00:00","fetched_at":"2026-11-07T06:03:31+00:00","note":"Fix 12.1.1.3 and affected range 12.1.0.0-12.1.1.2 come from the IBM CNA text (via OpenCVE/NVD). IBM release page node/7290205 confirms 12.1.1.3 exists; bulletin node/7295635 (12.1.1.3) is linked from the CVE but its fetched text was truncated before this CVE, so I did not mark anything verified. The CNA vector is PR:N (no login) while the text says authenticated; IBM's wording is inconsistent. No exploitation or PoC found, no workaround stated.","cites":["https://www.ibm.com/support/pages/node/7295635","https://www.ibm.com/support/pages/node/7290205","https://app.opencve.io/cve/CVE-2026-19128"]}],"documents":[{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93155,"url":"https://www.ibm.com/support/pages/node/7290205","title":"IBM API Connect v12.1.1.3 is now available","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":93235,"url":"https://app.opencve.io/cve/CVE-2026-19128","title":"OpenCVE: CVE-2026-19128 (carries IBM CNA text and vendor solution)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}