IBM API Connect: Server-side request forgery (CVE-2026-17188)
IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF) during the import of service definitions, allowing an authenticated attacker to access unauthorized internal resources.
CVE search metadata
CVE search record: CVE-2026-17188. Severity: high. CVSS: 8.5. KEV: no. Product: API Connect (12.1.0.0-12.1.1.2). Brief: IBM API Connect: Server-side request forgery (CVE-2026-17188). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-40d36208/
Triage facts
Revision 1- Applicability
- API Connect (12.1.0.0-12.1.1.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 06:02 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker can exploit this flaw by providing malicious references to external resources during the service definition import process. Successful exploitation allows the server to make requests to internal or restricted network resources, potentially leading to information disclosure.
Impact
An authenticated attacker can abuse the API import feature to perform reconnaissance on internal network infrastructure or access unauthorized services that are otherwise unreachable from the internet.
Recommendation
- Inventory all instances of IBM API Connect and identify those running versions 12.1.0.0 through 12.1.1.2.
- Monitor API gateway logs for unusual outbound requests originating from the API Connect server, particularly those targeting internal IP ranges or sensitive internal management interfaces.
- Apply the latest vendor security patches provided by IBM for API Connect to remediate CVE-2026-17188.
Immediate actions
Identify and patch IBM API Connect versions 12.1.0.0 through 12.1.1.2.
Threat Hunt
Monitor outbound network traffic from API Connect servers for requests to internal RFC1918 addresses.
Data: Egress firewall logs, Proxy logs
Mitigations
Upgrade IBM API Connect to a patched version beyond 12.1.1.2.
CVE-2026-17188