CVE-2026-7366

IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients’ IP addresses.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7282770	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:datapower_gateway::::::::
	cpe:2.3:a:ibm:datapower_gateway::::::::
	cpe:2.3:a:ibm:datapower_gateway::::::::

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) IBM DataPower Gateway 11.0.0.0 hasta 11.0.0.1 e IBM DataPower Gateway 10.5.0.0 hasta 10.5.0.21 e IBM DataPower Gateway 10.6.0.0 hasta 10.6.0.9 permite una condición de carrera que resulta en un aislamiento inadecuado del estado de la solicitud al manejar el encabezado X?Client?IP incorporado. Bajo el procesamiento concurrente de solicitudes, los valores de X?Client?IP pueden contaminarse entre solicitudes, lo que permite la suplantación de IP y la divulgación de las direcciones IP de otros clientes.

Information

Published : 2026-08-12 22:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-7366

Mitre link : CVE-2026-7366

CVE.ORG link : CVE-2026-7366

JSON object : View

Products Affected

ibm

datapower_gateway

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2026-7366", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7366", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T13:04:29.122885Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "DataPower Gateway 11.0.0", "versions": [{"status": "affected", "version": "11.0.0.0", "versionType": "semver", "lessThanOrEqual": "11.0.0.1"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.21:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "DataPower Gateway 10.5.0", "versions": [{"status": "affected", "version": "10.5.0.0", "versionType": "semver", "lessThanOrEqual": "10.5.0.21"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.9:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "DataPower Gateway 10.6.0", "versions": [{"status": "affected", "version": "10.6.0.0", "versionType": "semver", "lessThanOrEqual": "10.6.0.9"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-12T22:17:17.780", "references": [{"url": "https://www.ibm.com/support/pages/node/7282770", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built\u2011in X\u2011Client\u2011IP header. Under concurrent request processing, X\u2011Client\u2011IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients\u2019 IP addresses."}, {"lang": "es", "value": "IBM DataPower Gateway 11.0.0.0 hasta 11.0.0.1 e IBM DataPower Gateway 10.5.0.0 hasta 10.5.0.21 e IBM DataPower Gateway 10.6.0.0 hasta 10.6.0.9 permite una condici\u00f3n de carrera que resulta en un aislamiento inadecuado del estado de la solicitud al manejar el encabezado X?Client?IP incorporado. Bajo el procesamiento concurrente de solicitudes, los valores de X?Client?IP pueden contaminarse entre solicitudes, lo que permite la suplantaci\u00f3n de IP y la divulgaci\u00f3n de las direcciones IP de otros clientes."}], "lastModified": "2026-10-24T15:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BFF63F3E-42C0-405D-9F17-6AAEB0284BBC", "versionEndExcluding": "10.5.0.22", "versionStartIncluding": "10.5.0.0"}, {"criteria": "cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5EC15619-A831-4972-A897-60F3F98276C8", "versionEndExcluding": "10.6.0.10", "versionStartIncluding": "10.6.0.0"}, {"criteria": "cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E0753B8-F359-4B27-BD36-4E2BA6ADE8D6", "versionEndExcluding": "11.0.0.2", "versionStartIncluding": "11.0.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}