{"id":"CVE-2026-17325","published":"2026-11-07T05:18:42.510","lastModified":"2026-11-10T17:17:32.887","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability due to insufficient validation of user-supplied URLs, allowing an authenticated attacker to access internal or sensitive resources by redirecting requests to unintended endpoints.","exploitability":"Exploitation requires valid authentication and minimal skill, as the flaw stems from improper URL validation rather than complex logic manipulation.","blast_radius":"Successful exploitation could expose internal network services, credentials, or metadata stored in protected endpoints accessible to the API Connect server, potentially enabling further lateral movement or data exfiltration.","remediation":"Upgrade to IBM API Connect 12.1.1.3 or later, which addresses this SSRF vulnerability per vendor advisories.","detection":"Defenders should monitor for anomalous outbound HTTP/HTTPS requests from the API Connect server to internal IP ranges (e.g., 10.x.x.x, 192.168.x.x, 172.16.x.x–172.31.x.x), localhost (127.0.0.1), or metadata services (e.g., 169.254.169.254) in web server or proxy logs, especially when triggered by authenticated API calls with suspicious URL parameters.","tags":["ssrf","auth-bypass","web","api","ibm"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:50:15.312Z"}}