Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

IBM API Connect may leak data through forged requests

CVE-2026-17131 · published 1 day ago
Summary

Versions 12.1.0.0 to 12.1.1.2 of IBM API Connect can be tricked into contacting any web address and returning the result, allowing a remote attacker to see sensitive information. This happens because the product’s checks on outgoing requests can be bypassed. Apply the latest IBM patches or upgrade to a newer release and limit the destinations the server is allowed to reach.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm api connect <= 12.1.1.2
Original advisory text
Multiple Vulnerabilities in IBM API Connect
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published7 Nov 2026
Updated7 Nov 2026
First seen7 Nov 2026
Sources
CVE-2026-17131 · NVD
CVE-2026-17131 · MITRE
Track software like this
Free during beta