An authenticated remote attacker could exploit a server-side request forgery (SSRF) flaw in IBM API Connect 10.0.8.x and 12.1.x to obtain sensitive information.
What Is It
CVE-2026-17298 is a server-side request forgery vulnerability (CWE-918) in IBM API Connect. IBM's description says a remote attacker who is authenticated could use it to obtain sensitive information. IBM PSIRT reported the CVE, and NVD published it on November 7, 2026. NVD lists it as "Awaiting Analysis," so it has not yet done its own scoring or enrichment.
Why It Matters
IBM gave the flaw a CVSS v3.1 base score of 9.9 (CRITICAL) with this vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
In practice, that means:
- Network-reachable with low attack complexity
- Needs only low-privileged authentication
- Needs no user interaction
- Scope is changed, so the impact can reach beyond the vulnerable component
- High impact to confidentiality, integrity and availability
The written description only mentions disclosure of sensitive information. The vendor's vector, however, rates integrity and availability impact as high too. API Connect manages API traffic and access, so an attacker who already has a low-privileged account could use an SSRF bug here to reach internal resources.
Exploitation status: The NVD record and IBM advisories cited below do not report active exploitation, and none of the supplied data confirms any. Defenders should check the CISA Known Exploited Vulnerabilities (KEV) catalog directly for the current listing status.
What's Vulnerable
According to IBM's affected-product data, these IBM API Connect versions are vulnerable:
| Branch | Affected Versions |
|---|---|
| 10.0.8.x | 10.0.8.0 through 10.0.8.12 |
| 12.1.x | 12.1.0.0 through 12.1.1.2 |
Patch Status
IBM has published two support advisories for this CVE (linked below). The supplied NVD record does not list fixed versions or specific remediation steps. Administrators running an affected version should read the IBM advisories for fixes and upgrade guidance, and apply them as a priority given the critical rating.