CVE-2026-18505: IBM FTM Open Redirect Vulnerability

CVE-2026-18505 Overview

IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an open redirect vulnerability in the Payments Management Platform (PMP) HostHeaderFilter component. The flaw resides in HostHeaderFilter.java at line 151. An unauthenticated attacker can craft a request containing a manipulated Host header to redirect authenticated operators to attacker-controlled sites. This behavior enables credential phishing against FTM operators who trust the application origin. The vulnerability is classified under CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Unauthenticated attackers can redirect authenticated FTM operators to phishing pages by manipulating the HTTP Host header, enabling credential theft against financial transaction management personnel.

Affected Products

IBM Financial Transaction Manager (FTM) for RedHat OpenShift
Payments Management Platform (PMP) HostHeaderFilter component
Deployments exposing the PMP web interface to untrusted networks

Discovery Timeline

2026-09-23 - CVE-2026-18505 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-18505

Vulnerability Analysis

The vulnerability lives in the HostHeaderFilter servlet filter within the Payments Management Platform (PMP) module of IBM FTM for RedHat OpenShift. The filter is responsible for validating or processing the incoming HTTP Host header before the request reaches downstream handlers. At HostHeaderFilter.java:151, the filter uses the attacker-supplied Host header value when constructing a redirect response, without validating that the destination belongs to an allowlist of trusted hosts.

Because the flaw is exposed pre-authentication and requires only user interaction (clicking a link), attackers can weaponize legitimate FTM URLs. The redirect appears to originate from the trusted FTM domain, which increases the credibility of phishing pages hosted on attacker-controlled infrastructure.

Root Cause

The root cause is unsafe use of client-controlled input in URL construction, a classic instance of [CWE-601]. The HostHeaderFilter accepts the Host header from the HTTP request and incorporates it into a redirect Location header. Trust boundaries are not enforced between attacker-controlled request headers and server-generated redirect targets.

Attack Vector

An attacker crafts a URL pointing to a legitimate FTM PMP endpoint and delivers it via email, chat, or web page. When an authenticated operator opens the link, the manipulated Host header causes the server to issue a redirect to an attacker-controlled site that mimics the FTM login screen. The operator, believing they were logged out or need to re-authenticate, submits credentials to the phishing page. Because the initial URL and TLS certificate belong to the legitimate FTM deployment, standard user awareness checks fail.

No verified proof-of-concept code is publicly available. Refer to the IBM Support Page for the authoritative technical description.

Detection Methods for CVE-2026-18505

Indicators of Compromise

HTTP requests to PMP endpoints containing Host header values that do not match the deployment's canonical FQDN.
Server access logs showing 3xx redirect responses with Location values pointing to external, non-corporate domains.
User reports of unexpected redirection from FTM URLs to unfamiliar login pages.

Detection Strategies

Inspect reverse proxy and ingress controller logs for anomalous Host header values reaching the OpenShift route serving PMP.
Deploy web application firewall (WAF) rules that compare the Host header against an allowlist of approved FQDNs and alert on mismatches.
Correlate outbound user redirects with threat intelligence feeds to flag known phishing infrastructure.

Monitoring Recommendations

Enable verbose access logging on the OpenShift route and the PMP application server to capture full request headers.
Forward FTM and OpenShift ingress logs into a centralized analytics platform for retention and correlation.
Track authentication failure spikes that could indicate operators submitted credentials to a phishing page and later attempted legitimate logins.

How to Mitigate CVE-2026-18505

Immediate Actions Required

Apply the IBM security update referenced in the IBM Support advisory for FTM as soon as it is available for your deployment.
Restrict network exposure of the PMP interface to trusted operator networks or VPN-terminated segments.
Brief FTM operators on the phishing risk and instruct them to verify the browser address bar after any redirect from FTM URLs.

Patch Information

IBM has published an advisory for this vulnerability. Review the IBM Support Page for the affected FTM for RedHat OpenShift versions and the corresponding fix pack or container image update. Apply the vendor-supplied patch to the PMP component and redeploy affected OpenShift workloads.

Workarounds

Configure the OpenShift ingress controller or an upstream reverse proxy to enforce a strict Host header allowlist and reject requests with unexpected values.
Add a WAF rule that blocks HTTP responses containing Location headers pointing outside approved domains for PMP routes.
Educate operators to bookmark the canonical FTM URL and avoid following FTM links received via email until the patch is deployed.

bash

# Example NGINX ingress snippet enforcing a Host header allowlist for PMP
server {
    listen 443 ssl;
    server_name ftm.example.com;

    if ($host !~* ^(ftm\.example\.com)$) {
        return 400;
    }

    location / {
        proxy_set_header Host $host;
        proxy_pass https://pmp-backend;
    }
}