VYPR
← All advisories
Medium severity4.2NVD Advisory· Published Aug 12, 2026· Updated Aug 17, 2026

CVE-2026-7366

CVE-2026-7366

Description

IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients’ IP addresses.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • IBM/Datapower Gateway2 versions
    cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*range: >=10.5.0.0,<10.5.0.22
    • (no CPE)range: 11.0.0.0 - 11.0.0.1, 10.5.0.0 - 10.5.0.21, 10.6.0.0 - 10.6.0.9

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.