CVE-2026-19267: IBM FTM Authentication Bypass Vulnerability

CVE-2026-19267 Overview

IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a missing authentication vulnerability in the Business Rules Manager commands REST endpoint. The flaw resides in CommandsResource.java:31, where the endpoint accepts commands without verifying the caller's identity. A local actor can invoke unauthenticated commands to trigger resource exhaustion. Successful exploitation halts business-rule management functions, disrupting transaction processing workflows. The weakness is classified as Missing Authentication for Critical Function [CWE-306].

Critical Impact

Unauthenticated local invocation of Business Rules Manager commands causes resource exhaustion and denial of service against business-rule management functions.

Affected Products

• IBM Financial Transaction Manager (FTM) for RedHat OpenShift

Discovery Timeline

• 2026-09-23 - CVE CVE-2026-19267 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-19267

Vulnerability Analysis

The vulnerability affects the Business Rules Manager component of IBM FTM for RedHat OpenShift. The CommandsResource REST endpoint exposes command operations without enforcing authentication controls. Any local actor with network reachability to the service can send crafted requests to the endpoint. Repeated invocation of these commands drives the service into resource exhaustion.

The attack requires local access but no privileges or user interaction. Confidentiality and integrity are not directly impacted, but availability is severely affected. Business-rule management functions become unresponsive, which prevents administrators from updating or evaluating transaction rules.

Root Cause

The root cause is the absence of an authentication check on the REST endpoint declared in CommandsResource.java at line 31. The endpoint should validate the requesting principal before dispatching commands. Because that validation is missing, the endpoint treats all requests as authorized, allowing unauthenticated command invocation.

Attack Vector

The attack vector is local. An actor with access to the FTM service network path issues HTTP requests directly against the CommandsResource endpoint. No credentials, tokens, or session context are required. The actor repeats command invocations to consume backend resources until the Business Rules Manager stops servicing legitimate requests.

See the IBM Support Article for vendor-supplied technical details.

Detection Methods for CVE-2026-19267

Indicators of Compromise

• Unexplained spikes in HTTP requests to the CommandsResource REST endpoint from local network sources.
• Business Rules Manager service becoming unresponsive or reporting sustained high CPU and memory utilization.
• Absence of authentication headers on requests reaching the FTM commands endpoint.

Detection Strategies

• Enable REST access logging on the FTM Business Rules Manager and alert on requests to CommandsResource that lack authentication context.
• Baseline normal request rates against the commands endpoint and flag statistical deviations.
• Correlate service health metrics with inbound request patterns to identify resource-exhaustion behavior.

Monitoring Recommendations

• Monitor OpenShift pod resource metrics for the FTM Business Rules Manager container and alert on sustained saturation.
• Instrument reverse proxies or service meshes in front of FTM to log all requests to the commands endpoint.
• Forward FTM application logs into a centralized SIEM for correlation with network telemetry.

How to Mitigate CVE-2026-19267

Immediate Actions Required

• Apply the IBM-issued fix referenced in the IBM Support Article as soon as it is validated in a test environment.
• Restrict network access to the FTM Business Rules Manager commands endpoint to trusted administrative sources only.
• Review authentication and authorization configuration on all FTM REST endpoints for similar exposure.

Patch Information

Refer to the IBM Support Article for the official remediation guidance and fixed component versions for IBM Financial Transaction Manager for RedHat OpenShift.

Workarounds

• Enforce network policies within OpenShift to block untrusted pods and namespaces from reaching the Business Rules Manager service.
• Place an authenticating reverse proxy or API gateway in front of the FTM REST interface to reject unauthenticated requests.
• Apply rate limiting to the CommandsResource endpoint to reduce the impact of resource-exhaustion attempts.

# Example OpenShift NetworkPolicy restricting access to the FTM Business Rules Manager
# Adjust namespaceSelector and podSelector to match your environment
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ftm-brm-restrict
  namespace: ftm
spec:
  podSelector:
    matchLabels:
      app: ftm-business-rules-manager
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              role: ftm-admin
      ports:
        - protocol: TCP
          port: 8443