{"id":"CVE-2026-17330","published":"2026-11-07T05:18:43.460","lastModified":"2026-11-10T17:17:33.040","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability (CWE-918) that allows an authenticated attacker to force the application to make unintended requests to internal or external systems, potentially exposing sensitive internal data or services.","exploitability":"Exploitation requires valid authentication credentials and the ability to submit crafted requests to vulnerable endpoints; no public exploit code is available, but the low attack complexity makes it feasible for skilled attackers.","blast_radius":"Successful exploitation could lead to unauthorized access to internal network resources, cloud metadata services, or sensitive backend systems accessible to the API Connect server, with high confidentiality impact and some integrity risk.","remediation":"Upgrade to IBM API Connect 12.1.1.3 or later, as this version includes fixes for CVE-2026-17330.","detection":"Defenders should monitor for anomalous outbound HTTP/HTTPS requests from the API Connect server to internal IP ranges (e.g., 10.x.x.x, 192.168.x.x, 172.16.x.x–172.31.x.x), localhost (127.0.0.1), or cloud metadata endpoints (e.g., 169.254.169.254) in firewall or proxy logs, especially when originating from authenticated user sessions with unusual request patterns.","tags":["ssrf","cwe-918","ibm","api-connect","auth-required","info-disclosure"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:50:42.841Z"}}