Server-Side Request Forgery Vulnerability in IBM API Connect
CVE-2026-75590

7.2HIGH

Key Information:

Vendor

IBM
Status
Api Connect
Vendor
CVE Published:
7 November 2026

What is CVE-2026-75590?

A vulnerability in IBM API Connect versions 12.1.0.0 to 12.1.1.2 enables remote attackers to perform server-side request forgery. This flaw allows unauthorized external entities to access internal network resources, potentially leading to information exposure. Attackers can exploit the bypass in the protection mechanism that is designed to block requests to internal addresses, allowing the server to contact sensitive internal services and reveal confidential information.

Affected Version(s)

API Connect 12.1.0.0 <= 12.1.1.2

References

https://www.ibm.com/support/pages/node/7295635
vendor-advisorypatch

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.