Race Condition Vulnerability in IBM DataPower Gateway Affects IP Address Isolation
CVE-2026-7366

4.2MEDIUM

Key Information:

Vendor

IBM
Status
Datapower Gateway 11.0.0
Datapower Gateway 10.5.0
Datapower Gateway 10.6.0
Vendor
CVE Published:
12 August 2026

What is CVE-2026-7366?

A race condition in IBM DataPower Gateway affects the proper isolation of request state when handling the built-in X-Client-IP header. This vulnerability can lead to contamination of X-Client-IP values across multiple concurrent requests. As a result, it may allow an attacker to spoof IP addresses and potentially disclose the IP addresses of other clients. This issue affects specific versions of the DataPower Gateway, making it essential for users to apply recommended patches to mitigate the risk associated with this vulnerability.

Affected Version(s)

DataPower Gateway 10.5.0 10.5.0.0 <= 10.5.0.21

DataPower Gateway 10.6.0 10.6.0.0 <= 10.6.0.9

DataPower Gateway 11.0.0 11.0.0.0 <= 11.0.0.1

References

https://www.ibm.com/support/pages/node/7282770
vendor-advisorypatch

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.