{"id":"CVE-2026-75590","kind":"vulnerability","aliases":["CVE-2026-75590"],"related":[],"title":"IBM API Connect: server-side request forgery leaks internal network data","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw, where a protection against requests to internal addresses can be bypassed. A remote attacker can make the server contact internal services and receive part of their responses.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","ssrf","vendor"],"not_affected_if":["other-versions"],"how_to_check":"Check your installed API Connect V12 on-prem (self-hosted) version. Versions v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 contains the fix. IBM's CVSS vector says no authentication is needed, so also check whether API Connect endpoints are reachable from untrusted networks.","fix":"Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds or interim fixes.","status":"open","published_at":"2026-11-07T05:19:01+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","triaged_at":"2026-11-07T05:52:12+00:00","updated_at":"2026-11-07T06:03:54+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:52:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: server-side request forgery leaks internal network data","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery flaw, where a protection against requests to internal addresses can be bypassed. A remote attacker can make the server contact internal services and receive part of their responses.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"internal services reachable, partial responses returned to attacker","analyst_note":"Confirm the fixed version and any configuration requirement from the IBM security bulletin for CVE-2026-75590; the NVD entry alone does not state them.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 are exposed, since the flaw is in the product's server-side request handling. Teams on other versions or other products are not affected by this signal. The sources do not say which deployment configurations are most exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000693,"input_tokens":4234,"output_tokens":539,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any configuration requirement from the IBM security bulletin for CVE-2026-75590; the NVD entry alone does not state them.","search":"'-2026':14A,17A '-75590':15A,18A '12.1.0.0':39B,80C '12.1.1.2':41B,82C 'access':89C 'address':57B,111C 'allow':84C 'api':2A,19A,24B,28B,36B,78C 'api-gateway':23B 'attack':63B,87C 'block':107C 'bypass':60B,114C 'connect':3A,20A,29B,37B,79C 'contact':68B,122C 'contain':42B 'could':83C,118C 'cve':13A,16A 'data':12A 'due':97C 'flaw':49B 'forgeri':8A,48B,103C 'gateway':25B 'host':32B 'ibm':1A,27B,35B,77C 'ibm-api-connect':26B 'inform':96C 'intern':10A,56B,69B,90C,110C,123C 'leak':9A 'made':120C 'make':65B 'network':11A,91C 'obtain':94C 'onprem':22A 'part':73B,127C 'protect':52B,105C 'receiv':72B 'remot':62B,86C 'request':7A,47B,54B,102C,108C 'resourc':92C 'respons':76B,130C 'return':126C 'self':31B 'self-host':30B 'sensit':95C 'server':5A,45B,67B,100C,117C 'server-sid':4A,44B,99C 'servic':70B,124C 'side':6A,46B,101C 'ssrf':33B 'v12':21A 'vendor':34B 'version':38B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM API Connect V12 (on-prem) versions 12.1.0.0 through 12.1.1.2. IBM scores it as exploitable over the network without credentials or user interaction: the protection that blocks requests to internal addresses can be bypassed, so the server can be made to contact internal services and return part of their responses. Other versions are not listed for this CVE in IBM's bulletin.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:03:54Z","by":"analyst","doc":"https://www.ibm.com/support/pages/ibm%C2%AE-api-connect-v12113-now-available","run_id":2000},"products":{"at":"2026-11-07T06:03:54Z","by":"analyst","doc":"https://www.ibm.com/support/pages/ibm%C2%AE-api-connect-v12113-now-available","run_id":2000},"workarounds":{"at":"2026-11-07T06:03:54Z","by":"analyst","doc":"https://www.ibm.com/support/pages/ibm%C2%AE-api-connect-v12113-now-available","run_id":2000},"how_to_check":{"at":"2026-11-07T06:03:54Z","by":"analyst","doc":"https://www.ibm.com/support/pages/ibm%C2%AE-api-connect-v12113-now-available","run_id":2000}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","selfhosted","ssrf","vendor"],"campaign_type":null,"search_a":"'-2026':14A,17A '-75590':15A,18A 'api':2A,19A 'connect':3A,20A 'cve':13A,16A 'data':12A 'forgeri':8A 'ibm':1A 'intern':10A 'leak':9A 'network':11A 'onprem':22A 'request':7A 'server':5A 'server-sid':4A 'side':6A 'v12':21A","search_b":"'12.1.0.0':39B '12.1.1.2':41B 'address':57B 'api':24B,28B,36B 'api-gateway':23B 'attack':63B 'bypass':60B 'connect':29B,37B 'contact':68B 'contain':42B 'flaw':49B 'forgeri':48B 'gateway':25B 'host':32B 'ibm':27B,35B 'ibm-api-connect':26B 'intern':56B,69B 'make':65B 'part':73B 'protect':52B 'receiv':72B 'remot':62B 'request':47B,54B 'respons':76B 'self':31B 'self-host':30B 'server':45B,67B 'server-sid':44B 'servic':70B 'side':46B 'ssrf':33B 'vendor':34B 'version':38B","search_c":"'12.1.0.0':80C '12.1.1.2':82C 'access':89C 'address':111C 'allow':84C 'api':78C 'attack':87C 'block':107C 'bypass':114C 'connect':79C 'contact':122C 'could':83C,118C 'due':97C 'forgeri':103C 'ibm':77C 'inform':96C 'intern':90C,110C,123C 'made':120C 'network':91C 'obtain':94C 'part':127C 'protect':105C 'remot':86C 'request':102C,108C 'resourc':92C 'respons':130C 'return':126C 'sensit':95C 'server':100C,117C 'server-sid':99C 'servic':124C 'side':101C","first_public_at":"2026-11-07T05:19:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75590","severity":null,"published_at":"2026-11-07T05:19:01+00:00","modified_at":"2026-11-07T05:19:01+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","fetched_at":"2026-11-07T05:46:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-75590:2000","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:03:54+00:00","modified_at":"2026-11-07T06:03:54+00:00","first_seen_at":"2026-11-07T06:03:54+00:00","fetched_at":"2026-11-07T06:03:54+00:00","note":"IBM bulletin (security-bulletin-multiple-vulnerabilities-ibm-api-connect-39) lists CVE-2026-75590: affects API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fix upgrade to v12.1.1.3 via Fix Central, workarounds None, no interim fix. Bulletin page metadata says up to 12.1.1.3 but table says 12.1.1.2. No exploitation or PoC seen; did not search social.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/ibm%C2%AE-api-connect-v12113-now-available"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93237,"url":"https://www.ibm.com/support/pages/ibm%C2%AE-api-connect-v12113-now-available","title":"IBM API Connect v12.1.1.3 is now available","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}