A server-side request forgery flaw in IBM API Connect 12.1.0.0 through 12.1.1.2 could let an unauthenticated remote attacker bypass outbound request restrictions and potentially obtain sensitive information.
What Is It
CVE-2026-17131 is a server-side request forgery (SSRF) vulnerability, classified as CWE-918, in IBM API Connect. IBM's description says restrictions on outbound requests can be bypassed. If that happens, an attacker could make the server contact unintended destinations and return the response, which could expose sensitive information.
IBM PSIRT reported the issue, and NVD published it on 2026-11-07. The NVD record is still marked "Awaiting Analysis."
Why It Matters
IBM gives the flaw a CVSS v3.1 base score of 9.3 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N:
- Network-reachable: the vector rates the attack as low complexity, with no privileges or user interaction needed.
- Changed scope: the scoring indicates the impact could reach resources beyond the vulnerable component, which fits an SSRF that may be able to reach unintended destinations.
- High confidentiality impact: the main risk the score reflects is data exposure. Integrity impact is rated low and availability is rated as not affected.
API Connect is an API management platform, so a bypass of its outbound request controls could let attackers reach destinations that should be off-limits.
This CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the supplied data does not confirm active exploitation. Because the flaw is rated critical and reportedly needs no authentication, it should still be a high priority.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2 (inclusive)
Patch Status
The supplied NVD data does not name a fixed version or a specific remediation. IBM has published a security bulletin for this issue, and organizations running API Connect 12.1.0.0 through 12.1.1.2 should follow it for fix and mitigation guidance.
The CVE is not in KEV, so no CISA required action or due date applies. Until a fix is applied, find all API Connect deployments in the affected range and prioritize them for remediation.