{"id":"CVE-2026-16918","published":"2026-11-07T05:18:22.803","lastModified":"2026-11-10T16:51:40.550","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources due to server-side request forgery.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-918"],"vendors":["ibm"],"products":["api connect"],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["Vendor Advisory"]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect contains a server-side request forgery (SSRF) vulnerability (CWE-918) that allows unauthenticated remote attackers to trick the appliance into making unintended requests to internal network services, potentially exposing internal resources.","exploitability":"Exploitation is straightforward for remote attackers as it requires no authentication, low privileges, or user interaction, and likely involves crafting malicious API requests that redirect internal HTTP calls to internal endpoints.","blast_radius":"Successful exploitation could allow attackers to access internal services such as metadata endpoints, configuration servers, or management interfaces, leading to data exfiltration or further lateral movement within the internal network.","remediation":"Upgrade IBM API Connect to version 10.0.8.13 or later for the 10.0.8.x branch, or to version 12.1.1.3 or later for the 12.1.x branch.","detection":"Defenders should monitor for anomalous internal HTTP requests originating from API Connect services—such as requests to loopback addresses (127.0.0.0/8), link-local addresses (169.254.0.0/16), or private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)—in proxy or access logs, especially when the source IP is the API Connect appliance itself.","tags":["ssrf","web-api","internal-exposure","no-auth"],"model":"garnet-coder","analyzedAt":"2026-11-07T10:01:03.995Z"}}