CVE-2026-7366

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.1 IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.21 IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.9

Description A race condition occurs during the handling of the built-in X-Client-IP header, leading to improper isolation of request state. During concurrent request processing, values within the X-Client-IP header may be contaminated across different requests. This can result in IP spoofing and the disclosure of IP addresses belonging to other clients.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.