CVE-2026-7366

{
  "id": "CVE-2026-7366",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-12T22:17:17.780",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients’ IP addresses."
    },
    {
      "lang": "es",
      "value": "IBM DataPower Gateway 11.0.0.0 hasta 11.0.0.1 e IBM DataPower Gateway 10.5.0.0 hasta 10.5.0.21 e IBM DataPower Gateway 10.6.0.0 hasta 10.6.0.9 permite una condición de carrera que resulta en un aislamiento inadecuado del estado de la solicitud al manejar el encabezado X?Client?IP incorporado. Bajo el procesamiento concurrente de solicitudes, los valores de X?Client?IP pueden contaminarse entre solicitudes, lo que permite la suplantación de IP y la divulgación de las direcciones IP de otros clientes."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "IBM",
          "product": "DataPower Gateway 11.0.0",
          "defaultStatus": "unaffected",
          "cpes": [
            "cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.1:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "11.0.0.0",
              "lessThanOrEqual": "11.0.0.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "IBM",
          "product": "DataPower Gateway 10.5.0",
          "defaultStatus": "unaffected",
          "cpes": [
            "cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.21:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "10.5.0.0",
              "lessThanOrEqual": "10.5.0.21",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "IBM",
          "product": "DataPower Gateway 10.6.0",
          "defaultStatus": "unaffected",
          "cpes": [
            "cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.9:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "10.6.0.0",
              "lessThanOrEqual": "10.6.0.9",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 4.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-13T13:04:29.122885Z",
          "id": "CVE-2026-7366",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "10.5.0.0",
              "versionEndExcluding": "10.5.0.22",
              "matchCriteriaId": "BFF63F3E-42C0-405D-9F17-6AAEB0284BBC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "10.6.0.0",
              "versionEndExcluding": "10.6.0.10",
              "matchCriteriaId": "5EC15619-A831-4972-A897-60F3F98276C8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "11.0.0.0",
              "versionEndExcluding": "11.0.0.2",
              "matchCriteriaId": "1E0753B8-F359-4B27-BD36-4E2BA6ADE8D6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7282770",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}