{"id":"CVE-2026-17352","published":"2026-11-07T05:18:46.690","lastModified":"2026-11-10T17:17:33.330","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability (CWE-918) that allows an authenticated remote attacker to force the application to make unintended requests to internal or external systems, potentially exposing sensitive internal data or services.","exploitability":"Exploitation requires valid authentication credentials and no user interaction, with low attack complexity, making it feasible for compromised or insider accounts to abuse.","blast_radius":"Successful exploitation could lead to unauthorized access to internal network resources, cloud metadata services, or backend systems accessible to the vulnerable API Connect instance, with high confidentiality impact.","remediation":"Upgrade to IBM API Connect 12.1.1.3 or later, as this version contains the fix for CVE-2026-17352.","detection":"Defenders should monitor for anomalous outbound HTTP/HTTPS requests from the API Connect gateway or management components to internal IP ranges (e.g., 10.x.x.x, 192.168.x.x), localhost (127.0.0.1), or cloud metadata endpoints (e.g., 169.254.169.254) in gateway access logs or proxy logs, especially when originating from authenticated but low-privilege user sessions.","tags":["ssrf","cwe-918","ibm","api-connect","auth-bypass","info-disclosure"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:51:01.292Z"}}