CVE-2026-17372
Awaiting Analysis
Awaiting Analysis - Queue
IBM API Connect Webhook URL Validation Bypass
Vulnerability report for CVE-2026-17372, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-07
Last updated on: 2026-11-07
Assigner: IBM Corporation
Description
Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to probe internal network resources due to insufficient validation of webhook destination URLs. User-configured webhook addresses are not sufficiently restricted, so the server could be made to contact internal systems.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| IBM | API Connect | From 12.1.0.0 (inc) to 12.1.1.2 (inc) |
| IBM | API Connect | From 10.0.8.0 (inc) to 10.0.8.12 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
