{"id":"CVE-2026-17397","published":"2026-11-07T05:18:55.330","lastModified":"2026-11-07T05:18:55.503","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a server-side request forgery (SSRF) vulnerability (CWE-918) that allows an authenticated attacker to force the application to make unintended requests to internal or external systems, potentially exposing sensitive internal data or services.","exploitability":"Exploitation requires valid authentication and low skill, as the flaw is a classic SSRF pattern exploitable via crafted API requests targeting internal endpoints.","blast_radius":"Successful exploitation could lead to unauthorized access to internal cloud metadata services, local network resources, or sensitive APIs, compromising confidentiality of internal systems and enabling lateral movement.","remediation":"Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3 or later, as these versions include the fix for CVE-2026-17397.","detection":"Defenders should monitor for anomalous outbound HTTP/HTTPS requests from API Connect management or gateway nodes to internal IP ranges (e.g., 10.x.x.x, 192.168.x.x, 169.254.x.x) or unexpected domains, especially when originating from authenticated user sessions with no legitimate business need for such requests.","tags":["ssrf","cwe-918","ibm","api-connect","auth-bypass","info-disclosure"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:52:13.107Z"}}