CVE-2026-17635: IBM FTM Authentication Bypass Vulnerability

CVE-2026-17635 Overview

CVE-2026-17635 is a critical missing authentication vulnerability [CWE-306] in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift. The flaw stems from improper configuration of HTTP method-based security constraints. A remote, unauthenticated attacker can perform unauthorized actions by sending HTTP requests using methods not covered by the enforced access controls.

The vulnerability affects the confidentiality and integrity of transaction data processed by FTM. Because FTM handles financial messaging, exploitation could enable manipulation of payment workflows or exposure of sensitive transaction records. Full technical guidance is available on the IBM Support Page.

Critical Impact
Unauthenticated remote attackers can bypass HTTP method-based access controls to read or modify financial transaction data in IBM FTM for Red Hat OpenShift.

Affected Products

IBM Financial Transaction Manager (FTM) for Red Hat OpenShift

Discovery Timeline

2026-09-22 - CVE-2026-17635 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-17635

Vulnerability Analysis

The vulnerability is classified as Missing Authentication for Critical Function [CWE-306]. IBM FTM for Red Hat OpenShift defines security constraints that gate access to sensitive endpoints. Those constraints enumerate specific HTTP methods, such as GET and POST, rather than protecting all methods on the resource.

When a security constraint lists methods explicitly, servlet containers apply the constraint only to those listed methods. Any HTTP method not enumerated, such as PUT, DELETE, HEAD, or arbitrary method names, is treated as unconstrained. Requests using such methods reach the underlying handler without authentication or authorization checks.

The attack requires no privileges, no user interaction, and can be executed over the network. Impact covers unauthorized reads and unauthorized state changes against financial transaction functions.

Root Cause

The root cause is an incomplete <http-method> allowlist inside the application's web.xml or equivalent declarative security configuration. Restricting a <security-constraint> to named methods leaves all other methods unprotected. This is a well-known servlet-specification behavior that requires either the use of <http-method-omission> or the removal of method-level filtering.

Attack Vector

An attacker sends an HTTP request to a protected FTM endpoint using a method not enumerated in the security constraint. The container skips authentication and dispatches the request. Depending on the endpoint, the attacker can enumerate resources, modify transaction state, or invoke administrative functions without credentials. See the IBM Support Page for the vendor's technical bulletin and fix details.

Detection Methods for CVE-2026-17635

Indicators of Compromise

HTTP requests to FTM endpoints using uncommon methods such as PUT, DELETE, PATCH, HEAD, OPTIONS, or non-standard verbs.
Access log entries showing successful responses (2xx) to protected paths without a preceding authentication event.
Unexpected state changes in transaction records that do not correlate with authenticated user sessions.

Detection Strategies

Parse OpenShift route and ingress logs for requests to FTM paths where the HTTP method is not GET or POST and no authorization header is present.
Correlate application audit logs with authentication logs to surface handler invocations that lack a bound user identity.
Deploy signatures on web application firewalls to flag requests using rare HTTP methods against FTM URIs.

Monitoring Recommendations

Enable verbose access logging on the FTM OpenShift routes and forward logs to a centralized analytics platform.
Baseline the set of HTTP methods normally used by FTM clients and alert on deviations.
Monitor for repeated 4xx-to-2xx transitions on the same URI, which may indicate method-switching probes.

How to Mitigate CVE-2026-17635

Immediate Actions Required

Apply the IBM-provided fix referenced on the IBM Support Page as soon as maintenance windows allow.
Restrict network exposure of FTM OpenShift routes to trusted client networks until patching is complete.
Enforce authentication at an upstream reverse proxy or API gateway to compensate for the container-level gap.

Patch Information

IBM has published guidance and remediation instructions on the IBM Support Page. Administrators should identify the affected FTM for Red Hat OpenShift release in their environment and apply the vendor-recommended interim fix or upgraded image.

Workarounds

Reconfigure web.xml security constraints to remove <http-method> enumerations so protections apply to all methods, or use <http-method-omission> to explicitly cover the intended verbs.
Deploy a web application firewall rule that rejects HTTP methods other than the explicit set required by FTM clients.
Terminate client sessions at an authenticating ingress controller that enforces authorization on every request regardless of method.

bash

# Example OpenShift Route annotation to restrict allowed HTTP methods at the ingress layer
oc annotate route ftm-route \
  haproxy.router.openshift.io/allowed-methods="GET,POST" \
  --overwrite