An unauthenticated server-side request forgery flaw in IBM API Connect 12.1.0.0 through 12.1.1.2 could let a remote attacker obtain sensitive information.
What Is It
CVE-2026-17344 is a server-side request forgery (SSRF) vulnerability, classified as CWE-918, in IBM API Connect. IBM's description says a service that can be reached without authentication could be made to send requests to unintended destinations. A remote attacker could use this to obtain sensitive information.
IBM PSIRT published the record to NVD on 2026-11-07. Its NVD status is "Awaiting Analysis," so NVD has not yet published its own assessment.
Why It Matters
IBM gives the flaw a CVSS v3.1 base score of 9.3 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. In plain terms:
- Network attack vector, low complexity: it can be exploited remotely with no special conditions.
- No privileges or user interaction required: the vulnerable service is reachable without authentication.
- Scope changed: the impact can reach resources beyond the vulnerable component itself. This fits SSRF, where the server sends requests to destinations the attacker chooses.
- High confidentiality impact, low integrity impact, no availability impact.
API Connect is an API management platform, so it often sits at the boundary between external clients and internal services. That makes an unauthenticated SSRF in it especially concerning.
Exploitation status: No CISA KEV entry was supplied for this CVE, so CISA has not confirmed active exploitation. Treat it as a high-priority patch anyway, given the severity and the lack of authentication.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2, inclusive
The source data lists no other products or version ranges.
Patch Status
The NVD record links to an IBM support advisory for this issue. The supplied data does not name a fixed version or give specific remediation steps, and no CISA required action or due date exists because there is no KEV entry. If you run API Connect 12.1.0.0–12.1.1.2:
- Check the IBM advisory below for the fixed release or workaround IBM recommends, and apply it.
- Make an inventory of exposed API Connect instances so you can prioritize any that are reachable from the internet.
Sources
- NVD, CVE-2026-17344
- IBM Support; Security Bulletin (node 7295635)
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)