CVE-2026-18251: IBM i WebSocket Information Disclosure Flaw

CVE-2026-18251 Overview

CVE-2026-18251 is an information disclosure vulnerability affecting IBM i versions 7.6, 7.5, 7.4, and 7.3. The flaw stems from improper validation of the WebSocket origin header, allowing a remote attacker to obtain sensitive information when a targeted user interacts with attacker-controlled content. The weakness is classified under [CWE-1385] (Missing Origin Validation in WebSockets). Successful exploitation requires user interaction and yields confidentiality impact without affecting integrity or availability.

Critical Impact
Remote attackers can leverage cross-origin WebSocket connections to exfiltrate sensitive information from IBM i systems when a user is lured to a malicious page.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-09-14 - CVE-2026-18251 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-18251

Vulnerability Analysis

The vulnerability resides in the WebSocket handling logic of IBM i. The affected component fails to validate the Origin header presented during the WebSocket handshake. WebSockets are not subject to the same-origin policy in the way traditional XHR requests are, so servers must explicitly verify that the connecting origin is trusted. When this check is missing or improperly implemented, an attacker-controlled web page can open a WebSocket connection to the IBM i server using the victim's authenticated session context.

The result is a Cross-Site WebSocket Hijacking (CSWSH) condition. Data transmitted over the socket can be read by the attacker's script, exposing session content or sensitive backend responses to unauthorized parties.

Root Cause

The root cause is missing or insufficient origin validation on the server side of the WebSocket handshake, as described by [CWE-1385]. The server accepts upgrade requests without confirming that the Origin header matches an allowlist of trusted domains, allowing cross-origin browser clients to establish authenticated sockets.

Attack Vector

Exploitation requires a network-adjacent attacker to host malicious web content and convince an authenticated IBM i user to visit it. The attacker's page initiates a WebSocket connection to the vulnerable IBM i endpoint. Because the victim's browser transmits session cookies during the handshake and the server does not reject the untrusted origin, the attacker-controlled script can read messages exchanged over the socket. No privileges are required on the target system, but user interaction is mandatory.

Refer to the IBM Support Page for vendor-specific technical details.

Detection Methods for CVE-2026-18251

Indicators of Compromise

WebSocket handshake requests to IBM i endpoints containing an Origin header from unexpected or external domains.
Unusual outbound WebSocket sessions initiated shortly after users visit third-party web content.
Repeated HTTP 101 Switching Protocols responses from IBM i services to sessions with mismatched Referer and Origin values.

Detection Strategies

Inspect web server and reverse proxy logs for WebSocket upgrade requests where the Origin header does not match approved corporate domains.
Correlate browser telemetry with server logs to identify user sessions establishing WebSocket connections after navigating to untrusted external sites.
Deploy content inspection rules on network security appliances to flag WebSocket handshakes lacking a trusted origin.

Monitoring Recommendations

Enable verbose logging of Origin, Sec-WebSocket-Key, and Referer headers on all WebSocket-capable IBM i services.
Alert on any WebSocket session terminating with abnormal data volumes relative to baseline user activity.
Continuously monitor authentication events on IBM i for session use from geographically or behaviorally anomalous contexts.

How to Mitigate CVE-2026-18251

Immediate Actions Required

Apply the IBM-provided fix documented on the IBM Support Page to all affected IBM i 7.3, 7.4, 7.5, and 7.6 systems.
Restrict access to IBM i WebSocket endpoints to trusted internal networks where possible.
Instruct users to avoid interacting with untrusted links while authenticated to IBM i services.

Patch Information

IBM has released remediation guidance and product-specific fixes. Administrators should consult the IBM Support Page for the current PTF (Program Temporary Fix) group corresponding to each affected release and apply them following standard IBM i change management procedures.

Workarounds

Configure a reverse proxy or web application firewall in front of IBM i to validate the Origin header and reject WebSocket handshakes from untrusted domains.
Enforce the SameSite=Strict attribute on session cookies used by IBM i web services to limit cross-site cookie transmission during WebSocket handshakes.
Require additional authentication tokens (for example, CSRF-style tokens) within WebSocket messages to prevent hijacked sessions from being useful to attackers.

bash

# Example NGINX reverse proxy configuration enforcing Origin validation
map $http_origin $origin_allowed {
    default 0;
    "https://ibmi.internal.example.com" 1;
    "https://portal.example.com" 1;
}

server {
    listen 443 ssl;
    server_name ibmi.example.com;

    location /ws/ {
        if ($origin_allowed = 0) {
            return 403;
        }
        proxy_pass http://ibmi_backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Origin $http_origin;
    }
}