{"id":"CVE-2026-17296","published":"2026-11-07T05:18:37.140","lastModified":"2026-11-11T05:19:40.293","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-918"],"vendors":["ibm"],"products":["api connect"],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["Vendor Advisory"]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect contains a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to trick the application into making unintended requests to internal or external services, potentially exposing sensitive internal data or services.","exploitability":"Exploitation requires valid authentication and network access to the affected API Connect instance; no public exploit is known, but SSRF flaws of this type are generally straightforward to trigger with crafted HTTP requests.","blast_radius":"Successful exploitation could lead to exposure of internal network resources, credentials, or metadata services (e.g., cloud instance metadata), compromising confidentiality and integrity of connected systems.","remediation":"Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x branch, or to 12.1.1.3 or later for the 12.1.x branch.","detection":"Look for outbound HTTP/HTTPS requests from the API Connect gateway or management components to unexpected internal IP ranges (e.g., 169.254.169.254, 10.x.x.x, 172.16.x.x–172.31.x.x), especially when triggered by authenticated user actions involving URL parameters or webhook configurations; also monitor for anomalous DNS lookups to internal domains in gateway logs.","tags":["ssrf","api-gateway","ibm","auth-bypass","internal-exposure"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:58:30.817Z"}}