EUVD-2026-57640
GHSA-p6wq-xx5g-mm4g
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-exploitable race condition requires concurrent timing luck (AC:H) and authenticated access (PR:L); impact limited to IP disclosure and spoofing with no availability consequence.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients’ IP addresses.
AnalysisAI
Race condition in IBM DataPower Gateway across three concurrent version lines (10.5.0.x, 10.6.0.x, and 11.0.0.x) permits state contamination of the built-in X-Client-IP header under concurrent request load, enabling IP spoofing and cross-client IP address disclosure. The flaw resides in IBM's enterprise API gateway and integration middleware, commonly deployed in high-throughput service meshes where simultaneous request processing is routine. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privilege authenticated session on the IBM DataPower Gateway, as indicated by CVSS PR:L - unauthenticated exploitation is not supported by the vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.2 (Medium) accurately reflects the real-world complexity barrier: AV:N confirms network exploitability, but AC:H captures the race condition's inherent timing dependency, which requires concurrent request overlap and is non-trivially reproducible in controlled fashion. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated attacker with access to the gateway sends a high volume of concurrent API requests timed to overlap with legitimate client traffic, deliberately widening the race window during X-Client-IP header state resolution. Due to the shared-state race condition, the attacker's requests may receive another client's IP address in logging and downstream service metadata, or the attacker observes a legitimate client's IP leaking into their own response context. … |
| Remediation | A patch is available per the IBM vendor advisory at https://www.ibm.com/support/pages/node/7282770. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Datapower Gateway 11 0 0
View allSame weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today