IBM DataPower Gateway X-Client-IP Race Condition Vulnerability (CVE-2026-7366) Advisory

Vulnerability Overview CVE Number: CVE-2026-7366 Description: IBM DataPower Gateway has a race condition when processing the built-in header, leading to improper request state isolation. During concurrent request processing, the value may be tainted across requests, enabling IP spoofing and exposing the IP addresses of other clients. CVE Number: CVE-362: Concurrency with shared resources (Race condition) CVSS Base Score: 4.2 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Scope of Impact Affected Products: - IBM DataPower Gateway 11.0.0 - IBM DataPower Gateway 10.5.0 - IBM DataPower Gateway 10.6.0 Remediation Recommendation: IBM strongly advises upgrading as soon as possible. Fixed Versions: - IBM DataPower Gateway 11.0.0 - IBM DataPower Gateway 10.5.0 - IBM DataPower Gateway 10.6.0 Temporary Mitigations Disable persistent connections with the XML Firewall, or do not set the header in client requests. Additional Information Publication Date: June 6, 2026 References: - Complete CVSS v3 Guide - Online Calculator v3 Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard" designed to convey vulnerability severity and help determine urgency and response priorities. IBM provides the CVSS score "as is," without any express or implied warranties, including but not limited to the implied warranties of merchantability and fitness for a particular purpose. Customers are responsible for evaluating any actual or potential security vulnerability risks. IBM periodically updates the known vulnerabilities record for components included in its products. Furthermore, IBM identifies packages that were previously undiscovered and addresses related vulnerabilities in the product/service list, regardless of their CVE date. If IBM discovers previously unrecognized packages, IBM treats them as known vulnerabilities, regardless of their CVE date. The inclusion of an earlier CVE does not mean that the product has been used by IBM since that date. IBM Security Bulletins are intended to cover only supported products and versions that IBM has identified and supports since that date. If IBM discovers previously unrecognized packages, IBM treats them as known vulnerabilities, regardless of their CVE date. The inclusion of an earlier CVE does not mean that the product has been used by IBM since that date. IBM Security Bulletins are intended to cover only supported products and versions that IBM has identified and supports since that date. If IBM discovers previously unrecognized packages, IBM treats them as known vulnerabilities, regardless of their CVE date. The inclusion of an earlier CVE does not mean that the product has been used by IBM since that date. IBM Security Bulletins are intended to cover only supported products and versions that IBM has identified and supports since that date. If IBM discovers previously unrecognized packages, IBM treats them as known vulnerabilities, regardless of their CVE date. The inclusion of an earlier CVE does not mean that the product has been used by IBM since that date. IBM Security Bulletins are intended to cover only supported products and versions that IBM has identified and supports since that date. If IBM discovers previously unrecognized packages, IBM treats them as known vulnerabilities, regardless of their CVE date. The inclusion of an earlier CVE does not mean that the product has been used by IBM since that date. IBM Security Bulletins are intended to cover only supported products and versions that IBM has identified and supports since that date. Document Location Global: - Business Unit: BU048 - Product: SSSH2Y - Component: IBM DataPower Gateway - Platform: PF009 - Version: 11.0.0, 10.6.0, 10.5.0 - Edition: None - Business Line: LOB77 - Tags: Automation Platform Document Information Modification Date: August 6, 2026 Initial Publication Date: June 6, 2026 UID: IBM17282770 Feedback Submit Feedback: Submit feedback to IBM Support Phone Support: 1-800-IBM-7378 (USA) Global Contacts Directory: Directory of worldwide contacts

Goal Reached Thanks to every supporter — we hit 100%!

IBM DataPower Gateway X-Client-IP Race Condition Vulnerability (CVE-2026-7366) Advisory

More from this source