CVE-2026-17131 — Ibm Api Connect
CRITICALCVE-2026-17131 is a critical-severity (CVSS 9.3) Server-Side Request Forgery (SSRF) vulnerability in ibm api connect. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be…
Description
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.
Affected Products
api connectibmDetection & mitigation playbook
Vendor / applianceDetect
Inventory every ibm api connect deployment and check each version against the affected-products list above.
Remediation status
The records we use list no fixed version for CVE-2026-17131. Check the ibm api connect advisory for a patched release, and apply the workarounds below until you can upgrade.
Mitigate without a patch
Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-17131 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.