Vulnerability-Lookup

CVE-2026-7366 (GCVE-0-2026-7366)

Vulnerability from cvelistv5 – Published: 2026-08-12 21:19 – Updated: 2026-08-12 21:19

Title

IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall

Summary

IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients’ IP addresses.

Severity

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

ibm

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7282770	vendor-advisorypatch

Impacted products

3 products

Vendor	Product	Version
IBM	DataPower Gateway 11.0.0	Affected: 11.0.0.0 , ≤ 11.0.0.1 (semver) cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.0:::::::* cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.1:::::::*
IBM	DataPower Gateway 10.5.0	Affected: 10.5.0.0 , ≤ 10.5.0.21 (semver) cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.0:::::::* cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.21:::::::*
IBM	DataPower Gateway 10.6.0	Affected: 10.6.0.0 , ≤ 10.6.0.9 (semver) cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.0:::::::* cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.9:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.1:*:*:*:*:*:*:*"
          ],
          "product": "DataPower Gateway 11.0.0",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "11.0.0.1",
              "status": "affected",
              "version": "11.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.21:*:*:*:*:*:*:*"
          ],
          "product": "DataPower Gateway 10.5.0",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "10.5.0.21",
              "status": "affected",
              "version": "10.5.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.9:*:*:*:*:*:*:*"
          ],
          "product": "DataPower Gateway 10.6.0",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "10.6.0.9",
              "status": "affected",
              "version": "10.6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built\u2011in X\u2011Client\u2011IP header. Under concurrent request processing, X\u2011Client\u2011IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients\u2019 IP addresses.\u003c/p\u003e"
            }
          ],
          "value": "IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built\u2011in X\u2011Client\u2011IP header. Under concurrent request processing, X\u2011Client\u2011IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients\u2019 IP addresses."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T21:19:41.018Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7282770"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM strongly advises upgrading as soon as possible.\u003cbr/\u003eAPAR: \u003ca href=\"https://www.ibm.com/mysupport/s/defect/aCIgJ000000D4FV/dt469107?language=en_US\" rel=\"nofollow\"\u003eDT469107\u003c/a\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eAffected Versions\u003c/td\u003e\u003ctd\u003eFixed in Release\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM DataPower Gateway 11.0.0 11.0.0.0 - 11.0.0.1\u003c/td\u003e\u003ctd\u003e11.0.0.2\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM DataPower Gateway 10.5.0 10.5.0.0 - 10.5.0.21\u003c/td\u003e\u003ctd\u003e10.5.0.22\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM DataPower Gateway 10.6.0 10.6.0.0 - 10.6.0.9\u003c/td\u003e\u003ctd\u003e10.6.0.10\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
            }
          ],
          "value": "IBM strongly advises upgrading as soon as possible.\nAPAR: DT469107\nAffected VersionsFixed in ReleaseIBM DataPower Gateway 11.0.0 11.0.0.0 - 11.0.0.111.0.0.2IBM DataPower Gateway 10.5.0 10.5.0.0 - 10.5.0.2110.5.0.22IBM DataPower Gateway 10.6.0 10.6.0.0 - 10.6.0.910.6.0.10"
        }
      ],
      "title": "IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDisable persistent connections to an XML Firewall service or don\u0027t set the X-Client-IP header on the client request.\u003c/p\u003e"
            }
          ],
          "value": "Disable persistent connections to an XML Firewall service or don\u0027t set the X-Client-IP header on the client request."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-7366",
    "datePublished": "2026-08-12T21:19:41.018Z",
    "dateReserved": "2026-04-28T20:55:47.917Z",
    "dateUpdated": "2026-08-12T21:19:41.018Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-7366\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2026-08-12T22:17:17.780\",\"lastModified\":\"2026-08-12T22:17:17.780\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built\u2011in X\u2011Client\u2011IP header. Under concurrent request processing, X\u2011Client\u2011IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients\u2019 IP addresses.\"}],\"affected\":[{\"source\":\"psirt@us.ibm.com\",\"affectedData\":[{\"vendor\":\"IBM\",\"product\":\"DataPower Gateway 11.0.0\",\"cpes\":[\"cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.1:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"11.0.0.0\",\"lessThanOrEqual\":\"11.0.0.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"IBM\",\"product\":\"DataPower Gateway 10.5.0\",\"cpes\":[\"cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.21:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"10.5.0.0\",\"lessThanOrEqual\":\"10.5.0.21\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"IBM\",\"product\":\"DataPower Gateway 10.6.0\",\"cpes\":[\"cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.9:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"10.6.0.0\",\"lessThanOrEqual\":\"10.6.0.9\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":4.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7282770\",\"source\":\"psirt@us.ibm.com\"}]}}"
  }
}

GHSA-P6WQ-XX5G-MM4G

Vulnerability from github – Published: 2026-08-13 00:31 – Updated: 2026-08-13 00:31

Details

Severity

4.2 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-7366"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-12T22:17:17Z",
    "severity": "MODERATE"
  },
  "details": "IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built\u2011in X\u2011Client\u2011IP header. Under concurrent request processing, X\u2011Client\u2011IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients\u2019 IP addresses.",
  "id": "GHSA-p6wq-xx5g-mm4g",
  "modified": "2026-08-13T00:31:27Z",
  "published": "2026-08-13T00:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7366"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7282770"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-7366 (GCVE-0-2026-7366)

GHSA-P6WQ-XX5G-MM4G

Tags

Sightings

Nomenclature