Description

IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from a privileged file when using SSH.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-04T16:17:21.270Z",
  "pubdate": "2026-09-04T16:17:21.270Z",
  "executiveSummary": "A security vulnerability exists within IBM i 7.5 and 7.6 that allows a local authenticated attacker to gain unauthorized access to information residing in privileged files when utilizing the SSH protocol.\nThis vulnerability is classified as an information disclosure issue, where insufficient access control mechanisms or improper file handling during SSH operations permit the exposure of sensitive data.\nThe scope of this vulnerability affects both IBM i 7.5 and 7.6 environments. The risk implications are significant, as unauthorized access to privileged system files can lead to the exposure of configuration data, credentials, or other system-level secrets, potentially facilitating further exploitation or lateral movement within the environment.\nExploitation of this vulnerability requires the attacker to already possess a local authenticated account on the target system. The attack does not require network-level access if the user can initiate an SSH session locally or through an established SSH connection.\nSuccessful exploitation allows an attacker to bypass standard file permission restrictions that should otherwise prevent a non-privileged user from reading sensitive information.",
  "technicalDetails": "The vulnerability resides within the interaction between the SSH service and the underlying file system access control mechanisms on IBM i 7.5 and 7.6. The root cause pertains to improper validation of file access requests when initiated through the SSH daemon or associated sub-processes.\nIn standard operation, SSH sessions on IBM i should enforce strict adherence to the Object Access Control List (OACL) and standard IFS (Integrated File System) permissions. However, the identified flaw indicates that when specific SSH-related functions are invoked, the system fails to correctly apply or enforce these authorization checks for privileged files.\nThe attack flow begins with a local user authenticated to the IBM i system. The attacker initiates an SSH session, which may be a remote SSH login or a local SSH loopback connection. By targeting specific file paths that are intended to be restricted to highly privileged accounts (e.g., QSECOFR or system-level service profiles), the attacker leverages the elevated context or the flawed access logic present in the SSH subsystem to perform read operations.\nBecause the SSH process handles file system access requests, if the process context is not correctly constrained, or if it utilizes a function that fails to verify the effective user profile against the target file's object authority, the privileged file is opened and its contents are returned to the attacker's session.\nThe impact of this behavior is that an attacker can exfiltrate sensitive data from files that are otherwise inaccessible. This might include system configuration files, private keys, or internal data structures that contain sensitive information about the system architecture or security configuration. By obtaining this information, an attacker can enumerate the system, identify further vulnerabilities, or harvest credentials for privilege escalation.\nThe technical failure is effectively a bypass of the system's Mandatory Access Control (MAC) or Discretionary Access Control (DAC) enforcement for SSH-based file system requests. This suggests that the interface between the SSH application and the IBM i kernel's object management services does not maintain the integrity of the permission check when performing file read/write operations."
}