CVE-2026-1491: IBM Security Verify Access Info Disclosure

CVE-2026-1491 Overview

IBM Verify Identity Access Container and IBM Security Verify Access products are affected by an HTTP Request Smuggling vulnerability (CWE-444) that could allow a remote attacker to access sensitive information. The vulnerability exists due to an inconsistent interpretation of HTTP requests by a reverse proxy, which can lead to unauthorized information disclosure when exploited.

Critical Impact

Remote attackers can exploit inconsistent HTTP request interpretation to bypass security controls and access sensitive data without authentication.

Affected Products

• IBM Verify Identity Access Container 11.0 through 11.0.2
• IBM Security Verify Access Container 10.0 through 10.0.9.1
• IBM Verify Identity Access 11.0 through 11.0.2
• IBM Security Verify Access 10.0 through 10.0.9.1

Discovery Timeline

• 2026-04-01 - CVE CVE-2026-1491 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-1491

Vulnerability Analysis

This vulnerability is classified as HTTP Request Smuggling (CWE-444), which occurs when a front-end server (such as a reverse proxy) and a back-end server interpret the boundaries of HTTP requests differently. In the context of IBM Verify Identity Access products, this inconsistency allows attackers to craft malicious HTTP requests that appear legitimate to the front-end proxy but are processed differently by the back-end application server.

The attack vector is network-based and requires no authentication or user interaction, making it accessible to remote attackers. However, the impact is limited to confidentiality exposure rather than integrity or availability compromise.

Root Cause

The root cause of this vulnerability lies in the improper handling of HTTP request parsing between the reverse proxy component and the backend services within the IBM Security Verify product suite. When multiple servers in a chain interpret HTTP headers or content-length values differently, attackers can "smuggle" additional requests that bypass security controls implemented at the proxy layer.

Attack Vector

HTTP Request Smuggling attacks typically exploit ambiguities in how servers determine where one request ends and another begins. Attackers craft requests containing multiple Content-Length headers or mixing Content-Length with Transfer-Encoding headers to cause desynchronization between the proxy and backend server. This can allow:

1. Bypassing front-end security controls and access restrictions
2. Gaining unauthorized access to sensitive user data
3. Potentially poisoning web caches
4. Hijacking user sessions in certain configurations

The vulnerability manifests through inconsistent HTTP request boundary parsing. When a reverse proxy forwards what it interprets as a single request, the backend server may parse it as two separate requests, with the "smuggled" second request potentially accessing protected resources. For detailed technical information and specific exploitation scenarios, refer to the IBM Support Page.

Detection Methods for CVE-2026-1491

Indicators of Compromise

• Anomalous HTTP request patterns with conflicting Content-Length and Transfer-Encoding headers
• Unexpected backend server responses containing data from unrelated requests
• HTTP access logs showing requests with malformed or duplicate HTTP headers
• Web application firewall alerts for HTTP desync or request smuggling signatures

Detection Strategies

• Implement deep packet inspection to identify requests with ambiguous length indicators
• Monitor for HTTP requests containing both Content-Length and Transfer-Encoding headers
• Review reverse proxy and backend server logs for timing anomalies indicating request desynchronization
• Deploy web application firewalls with HTTP Request Smuggling detection capabilities

Monitoring Recommendations

• Enable verbose logging on both reverse proxy and IBM Security Verify Access backend components
• Configure alerts for HTTP 400/502 errors that may indicate parsing inconsistencies
• Monitor network traffic for unusual request patterns targeting identity management endpoints
• Implement anomaly detection for authentication and session-related API calls

How to Mitigate CVE-2026-1491

Immediate Actions Required

• Apply the security patches provided by IBM for all affected product versions
• Review and update reverse proxy configurations to normalize HTTP requests before forwarding
• Implement strict HTTP parsing rules that reject ambiguous requests
• Audit network architecture to minimize attack surface of identity management components

Patch Information

IBM has released security updates to address this vulnerability. Administrators should consult the IBM Support Page for specific patch downloads and installation instructions for their affected product versions. It is recommended to upgrade IBM Verify Identity Access Container to versions beyond 11.0.2 and IBM Security Verify Access Container to versions beyond 10.0.9.1.

Workarounds

• Configure reverse proxies to use HTTP/2 for backend connections, which is not susceptible to traditional request smuggling
• Implement strict request validation at the reverse proxy layer to reject requests with conflicting length indicators
• Deploy a Web Application Firewall (WAF) with HTTP Request Smuggling detection and blocking capabilities
• Segment network access to restrict which systems can communicate with the IBM Security Verify infrastructure

# Example: Configure nginx reverse proxy to reject ambiguous requests
# Add to nginx.conf server block for IBM Verify Access proxy

# Reject requests with both Content-Length and Transfer-Encoding
if ($http_transfer_encoding ~* "chunked" ) {
    set $reject_smuggle "A";
}
if ($http_content_length) {
    set $reject_smuggle "${reject_smuggle}B";
}
if ($reject_smuggle = "AB") {
    return 400;
}

# Force HTTP/1.1 normalization
proxy_http_version 1.1;
proxy_set_header Connection "";