IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote attacker to obtain sensitive information. The vulnerability exists because an unauthenticated service can be induced to send requests to unintended destinations, potentially exposing confidential data.