{"id":"CVE-2026-17131","published":"2026-11-07T05:18:26.230","lastModified":"2026-11-07T05:18:26.387","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to bypass outbound request restrictions and force the server to contact arbitrary destinations, potentially leaking sensitive internal or external responses.","exploitability":"Exploitation requires no authentication or user interaction and is straightforward for an attacker with network access to the affected API Connect gateway.","blast_radius":"Successful exploitation could expose internal services, cloud metadata endpoints, or third-party APIs to the attacker, leading to data exfiltration, lateral movement, or further compromise of connected systems.","remediation":"Upgrade to IBM API Connect 12.1.1.3 or later, which contains the vendor-provided fix for CVE-2026-17131.","detection":"Defenders should monitor for outbound HTTP/HTTPS requests from the API Connect gateway to unexpected internal IP ranges (e.g., 10.x.x.x, 192.168.x.x, 172.16–31.x.x), localhost (127.0.0.1), or cloud metadata endpoints (e.g., 169.254.169.254) that correlate with external API calls or unusual timing patterns in gateway logs.","tags":["ssrf","ibm","web-api","info-leak","network"],"model":"garnet-coder","analyzedAt":"2026-11-07T10:01:16.078Z"}}