CWE-918: Server-Side Request Forgery vulnerabilities

IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a server-side request forgery (SSRF) vulnerability that allows a remote authenticated attacker to obtain sensitive information. The vulnerability is identified as CWE-918 and has a high severity score of 8.5. It requires low attack complexity and no user interaction but does require privileges to authenticate. The flaw impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows a remote attacker to bypass protections that block requests to internal addresses, enabling the server to access internal network resources and potentially disclose sensitive information.

CVE-2026-19128 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. An authenticated attacker could exploit this flaw to send unauthorized requests from the system, potentially enumerating internal network resources or facilitating further attacks. The vulnerability has a high severity rating with a CVSS score of 7.5.

CVE-2026-19122 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. An authenticated privileged attacker could exploit this flaw to send unauthorized requests from the system. This may allow the attacker to enumerate internal network resources or facilitate further attacks. The vulnerability has a low CVSS score of 3.8, indicating limited impact on confidentiality and integrity, with no impact on availability. No public exploits or known active exploitation have been reported. No patch information is provided in the available data.

CVE-2026-18836 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote attacker to make the affected component send requests to unintended destinations and receive the responses, potentially exposing sensitive information. The vulnerability has a high CVSS score of 9.3, indicating significant impact on confidentiality and integrity without requiring privileges or user interaction.

CVE-2026-17406 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw where address checks can be bypassed, allowing a remote authenticated attacker to make the server reach destinations that should be blocked and potentially obtain sensitive information.

CVE-2026-17404 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17398 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17397 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to perform server-side request forgery (SSRF), potentially leading to unauthorized access to sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17395 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests to internal network resources due to insufficient validation of user-supplied URLs. This improper restriction of destinations can expose internal systems to unauthorized access.

CVE-2026-17385 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to perform server-side request forgery (SSRF), potentially leading to unauthorized access to sensitive information. The vulnerability does not allow denial of service or full integrity compromise but can expose confidential data.

CVE-2026-17372 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests to internal network resources by exploiting insufficient validation of user-configured webhook destination URLs.

CVE-2026-17368 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to make the server send requests to unintended destinations, potentially performing network reconnaissance and obtaining sensitive credentials. The vulnerability has a CVSS 3.1 base score of 6.8, indicating medium severity.

CVE-2026-17365 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17361 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to cause the server to make unintended requests, potentially leading to the exposure of sensitive information. The vulnerability has a high severity rating with a CVSS score of 7.7.

CVE-2026-17357 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access internal network services. The vulnerability has a high severity with a CVSS score of 7.6.

CVE-2026-17355 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to bypass destination checks on outbound requests, potentially accessing sensitive information from internal network resources that should be blocked.

CVE-2026-17353 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass security restrictions and obtain sensitive information. The vulnerability has a high CVSS score of 9.6, indicating severe confidentiality and integrity impacts without availability impact.

CVE-2026-17352 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information. The vulnerability has a high severity with a CVSS score of 8.5, indicating significant confidentiality impact but limited integrity and no availability impact.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote attacker to cause the service to send requests to unintended destinations. This vulnerability can be exploited without authentication and may lead to the exposure of sensitive information.