CVE-2026-18875: IBM FTM Auth Bypass Vulnerability

CVE-2026-18875 Overview

CVE-2026-18875 affects IBM Financial Transaction Manager (FTM) for RedHat OpenShift. The vulnerability resides in the FTM AI agent server at api.vectordb.runbooks.js:51 and permits unauthenticated retrieval-augmented generation (RAG) poisoning through runbook upsert operations. An unauthenticated attacker on the network can insert malicious runbook content into the agent's vector database. That poisoned content then steers AI-driven Model Context Protocol (MCP) tool calls executed by the agent. The downstream impact includes unauthorized payment actions and exfiltration of payment data. The weakness is classified under [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection).

Critical Impact
Unauthenticated network attackers can poison the FTM AI agent's vector store to redirect autonomous MCP tool calls, potentially triggering unauthorized payments or leaking financial transaction data.

Affected Products

IBM Financial Transaction Manager (FTM) for RedHat OpenShift
FTM AI agent server component (api.vectordb.runbooks.js)
Deployments exposing the runbook upsert endpoint to untrusted networks

Discovery Timeline

2026-09-23 - CVE-2026-18875 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-18875

Vulnerability Analysis

The FTM AI agent server exposes a runbook upsert operation that writes documents into the agent's vector database without authenticating the caller. Runbooks stored in the vector database are retrieved at inference time and injected into the model context that governs MCP tool selection. When an attacker inserts adversarial runbook content, the agent treats the poisoned instructions as trusted operational guidance. The agent then issues MCP tool calls influenced by attacker-controlled text. In a payments context, those tool calls can initiate transactions or return sensitive data through legitimate agent channels.

Root Cause

The root cause is missing authentication and input neutralization on the runbook ingestion path in api.vectordb.runbooks.js at line 51. The endpoint accepts arbitrary content and commits it into the RAG corpus without provenance checks, allow-listing, or sanitization of embedded instructions. This mirrors classic injection weaknesses codified in [CWE-74], adapted to an AI data plane where the injected content becomes part of the model prompt rather than a shell or query.

Attack Vector

The attack vector is network based and requires no privileges or user interaction. An attacker with reachability to the FTM AI agent server sends a crafted upsert request that stores malicious runbook text in the vector database. On subsequent user or scheduled agent activity, the poisoned runbook is retrieved by similarity search and incorporated into the agent's context. The agent then executes MCP tool calls that align with the attacker's injected instructions, including payment-triggering tools and data-retrieval tools. See the IBM Support Page for vendor-provided technical detail.

Detection Methods for CVE-2026-18875

Indicators of Compromise

Unauthenticated HTTP requests to the FTM AI agent runbook upsert endpoint originating from non-administrative sources.
New or modified runbook documents in the vector database that lack an associated administrative change record.
Agent MCP tool invocations that do not correlate with a user-initiated task or approved workflow.
Anomalous outbound payment instructions or data retrieval calls issued by the FTM AI agent service account.

Detection Strategies

Log every write to the vector database and alert on upserts that lack an authenticated principal or approved change ticket.
Baseline normal runbook content length, embedding provenance, and source IP ranges, then flag deviations.
Correlate MCP tool call sequences with the retrieved runbook IDs to identify tool calls driven by unauthorized documents.

Monitoring Recommendations

Monitor network reachability to the FTM AI agent server and alert on connections from outside the trusted OpenShift namespace.
Track payment tool invocations by the agent and require out-of-band confirmation for high-value or bulk operations.
Retain agent prompt, retrieval, and tool-call telemetry for forensic reconstruction of poisoned runbook exploitation.

How to Mitigate CVE-2026-18875

Immediate Actions Required

Restrict network access to the FTM AI agent server so only authenticated internal services can reach the runbook API.
Disable or gate the runbook upsert endpoint until authentication and authorization are enforced on all write operations.
Audit the existing vector database for runbook entries with unknown provenance and remove suspicious documents.
Rotate credentials and tokens used by the FTM AI agent service account after any suspected poisoning event.

Patch Information

Refer to the IBM Support Page for CVE-2026-18875 for the vendor advisory, fixed component versions, and upgrade guidance for IBM Financial Transaction Manager for RedHat OpenShift.

Workarounds

Place the FTM AI agent server behind an authenticating reverse proxy that enforces mutual TLS or signed service tokens on runbook writes.
Apply OpenShift NetworkPolicy rules that permit ingress to the runbook API only from approved administrative pods.
Require human-in-the-loop approval for MCP tool calls that execute payments or export transaction data until the patch is applied.
Validate and sign runbook content at ingestion, and reject documents that fail signature or allow-list checks.

bash

# Example OpenShift NetworkPolicy restricting runbook API ingress
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: ftm-agent-runbook-restrict
  namespace: ftm
spec:
  podSelector:
    matchLabels:
      app: ftm-ai-agent
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              role: ftm-admin
      ports:
        - protocol: TCP
          port: 8443