CVE-2026-18169

IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an improper validation of symbolic links (CWE-22 path traversal) that a remote authenticated attacker can exploit to access files outside the intended directory. The flaw is triggered by an authenticated user crafting requests that leverage symlink or path manipulation to read arbitrary files on the underlying container or host filesystem, exposing sensitive data such as configuration, credentials, and transaction records. Although the description focuses on information disclosure, the CVSS 3.1 vector (9.9, scope changed, with high confidentiality, integrity, and availability impacts) indicates the issue may have broader consequences than simple file reads. Organizations affected are primarily banks, payment processors, and other financial institutions running FTM in OpenShift environments, where authenticated users include internal operators, service accounts, or integration partners. There is no known public proof of concept and no confirmed in-the-wild exploitation, and the CVE is not on the CISA KEV list.

What to do: Check the IBM PSIRT/X-Force advisory for the fixed release of FTM for RedHat OpenShift and apply it as soon as it is available, since no workaround is described in the CVE data. In the meantime, minimize and audit authenticated access to FTM (least-privilege roles, service account hygiene, MFA for operators) and monitor for anomalous file reads or unexpected symlink creation in FTM containers and mounted volumes. Because the CVSS scope is 'changed', also review container volume mounts and host-path exposures on the OpenShift workers running FTM to limit what a traversal could reach.