CVE-2026-18513: IBM Maximo Suite Auth Bypass Vulnerability

CVE-2026-18513 Overview

IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contains an improper access control vulnerability. The flaw stems from a schema-less Custom Resource Definition (CRD) in the Kubernetes-based deployment. An authenticated attacker with high privileges can abuse the missing schema validation to manipulate resources beyond their intended scope. Successful exploitation impacts confidentiality, integrity, and availability of the affected Maximo Location Service component. The weakness is tracked under CWE-269: Improper Privilege Management.

Critical Impact
An authenticated attacker can leverage a schema-less Custom Resource Definition to bypass access control boundaries in IBM Maximo Location Service for Esri, compromising confidentiality, integrity, and availability.

Affected Products

IBM Maximo Application Suite - Location Service for Esri Component 9.0
IBM Maximo Application Suite - Location Service for Esri Component 9.1
IBM Maximo Application Suite - Location Service for Esri Component 9.2

Discovery Timeline

2026-10-12 - CVE-2026-18513 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-18513

Vulnerability Analysis

The vulnerability affects the Location Service for Esri component within IBM Maximo Application Suite. The service runs on Kubernetes and extends the cluster API through a Custom Resource Definition. The CRD is defined without a validation schema, meaning the Kubernetes API server does not enforce structural constraints on fields submitted by clients. An authenticated user with permission to create or modify these custom resources can inject arbitrary fields and values that the controller consumes without rejection.

Because the controller acts on behalf of the Maximo platform with elevated service account permissions, improperly validated resource specifications can be translated into privileged operations. This produces a privilege management failure classified under [CWE-269], with downstream effects on data confidentiality, workload integrity, and service availability.

Root Cause

The root cause is a CustomResourceDefinition published without an OpenAPI v3 validation schema under spec.versions[].schema.openAPIV3Schema. Without schema enforcement, Kubernetes admission control cannot constrain the shape or content of custom resources, allowing an attacker to submit payloads that bypass intended access boundaries enforced by the operator logic.

Attack Vector

Exploitation requires network access to the Kubernetes API serving the Maximo Location Service for Esri component and valid credentials with permissions to interact with the vulnerable CRD. The attacker crafts custom resource manifests containing unexpected fields or values, submits them through standard Kubernetes API calls, and relies on the operator to process the manipulated specification with elevated privileges. User interaction is not required.

No verified public proof-of-concept code is available at the time of publication. Refer to the IBM Support Page for Node 7290070 for vendor technical details.

Detection Methods for CVE-2026-18513

Indicators of Compromise

Unexpected CustomResource objects or fields submitted against the Location Service for Esri CRD that do not match documented IBM Maximo schemas.
Kubernetes audit log entries showing create, update, or patch operations on Maximo Location Service CRDs by non-administrative service accounts.
Operator pod logs reporting reconciliation of resource specifications containing unknown keys or values outside normal operational ranges.

Detection Strategies

Enable Kubernetes API server audit logging at the RequestResponse level for all custom resources tied to the Maximo Location Service for Esri component.
Baseline the expected set of fields present in valid Location Service custom resources and alert on deviations detected during admission or reconciliation.
Correlate CRD modification events with the identity of the submitting user or service account to flag privileged activity from unexpected principals.

Monitoring Recommendations

Forward Kubernetes audit logs, operator logs, and Maximo application logs to a centralized analytics platform for cross-source correlation.
Monitor Role and RoleBinding changes that grant write access to the vulnerable CRD, especially outside documented maintenance windows.
Track anomalous outbound connections or configuration changes originating from the Location Service operator pod after suspicious CRD events.

How to Mitigate CVE-2026-18513

Immediate Actions Required

Apply the fixed version of IBM Maximo Application Suite - Location Service for Esri Component as published on the IBM Support Page for Node 7290070.
Restrict Kubernetes RBAC permissions on the Location Service CRD to the minimum set of administrators and service accounts required for operation.
Audit existing custom resources for unexpected fields or values and remediate any manifests that deviate from documented schemas.

Patch Information

IBM has published remediation guidance for CVE-2026-18513 on the IBM Support Page for Node 7290070. Administrators running IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, or 9.2 should upgrade to the version identified by IBM as containing the fix for the schema-less CRD.

Workarounds

Apply strict RBAC policies that remove create, update, and patch permissions on the affected CRD from any identity that does not require them.
Deploy an admission controller policy, for example using OPA Gatekeeper or Kyverno, that enforces an allowed field set on Location Service for Esri custom resources until the vendor patch is applied.
Isolate the Maximo Location Service namespace with network policies that limit API traffic to approved sources.

bash

# Example Kyverno policy restricting unknown fields on the affected CRD
# Replace <group> and <kind> with the values documented by IBM for the Location Service CRD
kubectl apply -f - <<EOF
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-maximo-location-crd
spec:
  validationFailureAction: Enforce
  rules:
    - name: allow-only-known-fields
      match:
        any:
          - resources:
              kinds:
                - <group>/<kind>
      validate:
        message: "Unknown fields are not permitted on Maximo Location Service CRs."
        pattern:
          spec:
            =(allowedField1): "?*"
            =(allowedField2): "?*"
EOF