Brief Summary: IBM API Connect CVE-2026-17344 Unauthenticated Server-Side Request Forgery

Introduction

IBM has fixed a server-side request forgery flaw in API Connect V12 OnPrem that lets a remote, unauthenticated attacker make an API Connect service send requests to destinations the attacker chooses. API management platforms often sit between external clients and internal systems, so a component that can be steered into making outbound requests offers a path to information that is not meant to be reachable from outside.

IBM API Connect is IBM's platform for managing the API lifecycle: development, testing, publication, governance, access control, analytics and developer discovery. IBM offers it for on-premises, hybrid and multicloud environments as well as SaaS, and reports being named a Leader in the 2026 Gartner Magic Quadrant for API Management for the 11th consecutive time. That claim describes market position, not security posture, but it does indicate the product runs in many enterprise API estates.

IBM rates the issue, tracked as CVE-2026-17344, at CVSS v3.1 9.3, and the fix is in API Connect 12.1.1.3.

Technical Information

Root cause

IBM and NVD classify the flaw as CWE-918, Server-Side Request Forgery. MITRE describes this weakness as a server that receives a URL or similar request and retrieves its contents without properly checking that the request goes to the expected destination. The server becomes the origin of the request, which can let an attacker get around access controls that would block a direct connection.

IBM's description of this instance is short: a service in API Connect that can be reached without authentication "could be made to send requests to unintended destinations", and a remote attacker could use this to obtain sensitive information.

The disclosure has clear limits. API Connect is closed source, and IBM has published no commit, diff or technical write-up. The bulletin does not name:

• the affected endpoint
• the request parameter
• the HTTP method
• the specific validation that fails

We therefore cannot reproduce the request from public material, and we do not include code or pseudocode.

CVSS breakdown

IBM's published vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Under the FIRST CVSS v3.1 specification, changed scope means the impact extends beyond the vulnerable component's security scope. It does not say which systems or data an attacker can reach in practice.

The confirmed impact is information disclosure. MITRE lists broader SSRF outcomes such as internal probing and protection bypass, but IBM does not confirm any of these for this CVE. IBM also does not confirm command execution, credential theft, a particular internal target or denial of service. The critical score reflects easy, unauthenticated reach combined with high confidentiality impact. It does not indicate a confirmed full system takeover.

Attack flow

Based only on IBM's description and the CWE-918 definition, the sequence looks like this:

1. A remote attacker reaches the affected API Connect service over the network. No credentials or user interaction are needed.
2. The attacker sends input that causes the service to issue a request to a destination the attacker chooses, rather than the one intended.
3. Because the request comes from the API Connect server, it may reach destinations the attacker could not contact directly.
4. Sensitive information is exposed to the attacker as a result.

IBM has not said which destinations are reachable or how the response gets back to the attacker.

Exploitation status

As of 7 November 2026, the reviewed sources do not confirm exploitation in the wild. IBM's bulletin makes no exploitation statement, and NVD is still awaiting enrichment.

OffSeq Threat Radar reports:

• no exploitation evidence on record
• no indexed public exploit in Metasploit or Exploit DB
• no indexed Nuclei template
• no attack traffic seen by its Mirage sensors

No threat actor, campaign or indicators of compromise have been identified. The CISA KEV snapshot we reviewed (version 2026.11.06) predates the NVD publication, so it does not settle the CVE's current KEV status. VulDB lists exploit maturity as "very low" while its entry remains "in review". All of these describe gaps in the available evidence, not proof that exploitation has not occurred.

Patch Information

Fixed version: IBM API Connect v12.1.1.3. IBM's security bulletin (document 7295635, published 5 November 2026) lists CVE-2026-17344 among the issues "addressed in IBM API Connect version v12.1.1.3".

• The bulletin covers API Connect V12 OnPrem v12.1.0.0 through v12.1.1.2.
• The only remedy is upgrading to v12.1.1.3.
• The "Workarounds and Mitigations" section reads "None", so no configuration change replaces the upgrade.
• NVD gives the same affected range and links back to the bulletin.

What the fix changes

IBM has not explained how it fixed the flaw. To close it, the fix has to stop the unauthenticated entry point from sending outbound requests to destinations an attacker chooses. Common SSRF fixes include:

• requiring authentication on the endpoint
• checking requested destinations against an allowlist
• blocking internal, loopback and link-local addresses after DNS resolution, so redirects and DNS rebinding cannot get around the check

These are general patterns, not confirmed details of IBM's change.

Part of a larger SSRF fix

The v12.1.1.3 bulletin bundles many CWE-918 fixes. Several are also unauthenticated and rated 9.3:

• CVE-2026-17131: "restrictions on outbound requests can be bypassed"
• CVE-2026-18836
• CVE-2026-16918
• CVE-2026-17329: improper validation of endpoint URLs
• CVE-2026-75590: an internal address block could be bypassed

This suggests IBM reworked outbound request handling across the product rather than patching a single endpoint. One upgrade closes CVE-2026-17344 and these related issues together. It also means there is no piecemeal backport: v12.1.1.3 is the only fixed version IBM offers.

Getting the update

IBM's release note (document 7290205) says v12.1.1.3 "delivers important security updates for API Connect customers". Downloads are on IBM Fix Central, which requires an IBM entitlement. Full installation files are on Passport Advantage. The Fix Central files include:

• per-subsystem upgrade bundles:

upgrade_management_12.1.1.3.tgz
upgrade_portal_12.1.1.3.tgz
upgrade_devportal_12.1.1.3.tgz
upgrade_analytics_12.1.1.3.tgz
upgrade_federatedapimanagement_12.1.1.3.tgz
upgrade_wmapigateway_12.1.1.3.tgz

• VMware OVA images
• the API Connect image tool archive and operator release files for container installs
• the apicup and apicupgrade tools
• a security signature bundle, 12.1.1.3_signatures.zip

OVA upgrades may also need the optional Control Plane file to bring Kubernetes to a supported level.

The bulletin does not say which subsystem contains the vulnerable service, so upgrade every API Connect subsystem to v12.1.1.3, not just one.

Upgrade path considerations

• Supported starting versions. The 12.1.1.3 release notes list 12.1.1.2, 12.1.1.1, 12.1.1.0 and 12.1.0.3. Do not assume a direct upgrade from every earlier release in the affected range.
• OpenShift. IBM's OpenShift planning document targets 12.1.1.4. It requires checking supported upgrade paths and compatibility, and using the correct operator, CASE file where applicable, and OpenShift version. Keep the bulletin's named fix (12.1.1.3) separate from the prerequisites of your deployment's upgrade procedure.

General SSRF controls are supplementary

The OWASP SSRF Prevention Cheat Sheet recommends:

• destination allowlisting
• disabling automatic redirect following
• connecting only to DNS-resolved addresses that have been validated
• network segregation to limit routes to required destinations

These are general application and network design controls, not IBM-confirmed workarounds or a tested remedy for this CVE. They do not replace the upgrade.

Version label quirk

The bulletin's "Affected Products and Versions" table ends at v12.1.1.2, but its document metadata shows "v12.1.0.0 to v12.1.1.3". That label covers the bulletin as a whole, including the fixed release. It does not mean v12.1.1.3 is vulnerable. NVD and the affected products table both put the last vulnerable version at 12.1.1.2.

Affected Systems and Versions

• The affected products table names API Connect V12 OnPrem only. The bulletin does not show that every API Connect deployment model is affected.
• Because the vulnerable subsystem is not identified, treat every subsystem in an affected V12 OnPrem installation as in scope for the upgrade.
• No configuration is described that removes exposure, since IBM publishes no workaround.

Vendor Security History

CVE-2025-13915: a different critical flaw

IBM's earlier CVE-2025-13915, first published on 17 December 2025, was an authentication bypass that could give a remote attacker unauthorized access to the application.

• IBM rated it CVSS 9.8.
• Affected versions were API Connect 10.0.8.0 through 10.0.8.5 and 10.0.11.0.
• Singapore's Cyber Security Agency documented the same score, impact and affected releases.
• IBM provided interim fixes. Customers unable to install them were advised to disable Developer Portal self-service sign-up, if enabled.

That workaround applied to a different vulnerability on a different product branch. It is not a documented mitigation for CVE-2026-17344, for which IBM lists no workaround.

Disclosure process

IBM describes PSIRT as its central vulnerability reporting process. It follows the FIRST stages of Discovery, Triage, Remediation and Disclosure, and IBM says it does not disclose or confirm vulnerabilities until analysis is complete and fixes or mitigations are available.

These cases show how IBM handles and documents critical issues. They do not tell us IBM's overall vulnerability rate or how it compares with other vendors.

References

• NVD: CVE-2026-17344
• CVE Record: CVE-2026-17344
• IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (document 7295635)
• IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (alternate URL)
• IBM API Connect v12.1.1.3 is now available (document 7290205)
• IBM Documentation: What's new in version 12.1.1.3
• IBM Documentation: Planning your API Connect upgrade on OpenShift
• IBM Documentation: Upgrading the Federated API Management subsystem on Kubernetes
• CVE Services API record for CVE-2026-17344
• NVD API record for CVE-2026-17344
• MITRE CWE-918: Server Side Request Forgery
• FIRST CVSS v3.1 Specification Document
• OWASP Server Side Request Forgery Prevention Cheat Sheet
• OffSeq Threat Radar: CVE-2026-17344
• VulDB: CVE-2026-17344
• CISA Known Exploited Vulnerabilities Catalog
• CISA KEV JSON Feed
• IBM Security Bulletin: Authentication bypass in IBM API Connect (CVE-2025-13915)
• Cyber Security Agency of Singapore: Critical Vulnerability in IBM API Connect
• IBM Security Vulnerability Management
• IBM API Connect product page
• IBM named a Leader in the 2026 Gartner Magic Quadrant for API Management