Description

IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients’ IP addresses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-12T22:17:17.780Z",
  "pubdate": "2026-08-12T22:17:17.780Z",
  "executiveSummary": "A race condition vulnerability has been identified in IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.1, 10.5.0.0 through 10.5.0.21, and 10.6.0.0 through 10.6.0.9. The flaw stems from the improper isolation of request state when processing the built-in X-Client-IP header under concurrent request processing conditions.\nThis vulnerability leads to request state contamination across distinct client transactions, allowing for IP spoofing and the unauthorized disclosure of other clients' IP addresses.\nThe risk implications include potential bypass of IP-based access controls, inaccurate audit logging, and unintended exposure of sensitive client network metadata to concurrent users.\nExploitation requires an attacker to leverage high-concurrency traffic conditions to trigger the race condition and interact with the vulnerable request state handling mechanism of the built-in header.\nImpact is focused on confidentiality and integrity breaches regarding client session context and network telemetry.",
  "technicalDetails": "The root cause of the vulnerability is a race condition occurring within the request processing lifecycle of IBM DataPower Gateway when handling the built-in X-Client-IP header. Specifically, the internal mechanism responsible for parsing, storing, and propagating the request state fails to maintain thread-safe isolation across concurrent execution contexts.\nUnder high-concurrency request processing, simultaneous execution threads access and modify shared memory structures or context buffers designated for the X-Client-IP header without proper synchronization primitives or transactional isolation. As a result, request state contamination occurs, causing the X-Client-IP value associated with one client transaction to leak into or overwrite the request context of a concurrent, independent transaction.\nThe affected component is the internal request routing and header management subsystem responsible for evaluating the built-in X-Client-IP header. Affected versions include IBM DataPower Gateway 11.0.0.0 through 11.0.0.1, 10.5.0.0 through 10.5.0.21, and 10.6.0.0 through 10.6.0.9.\nThe attack flow proceeds as follows: First, an attacker establishes multiple concurrent connections to the DataPower Gateway. Second, the attacker transmits crafted requests designed to coincide precisely with requests sent by other legitimate clients. Third, due to the lack of proper state isolation during concurrent request handling, the gateway interleaves execution and misbinds the X-Client-IP header context. Finally, the attacker either successfully spoofs an arbitrary IP address for their own session or captures the leaked IP address of another concurrent client within application responses, logs, or downstream processing logic.\nAuthentication and privilege requirements depend on the exposure of the vulnerable endpoints, but exploitation can generally be executed by unauthenticated network-adjacent attackers capable of generating concurrent traffic against the gateway. Network exposure is tied to the accessibility of the services hosted on the IBM DataPower Gateway.\nPost-exploitation impact includes the ability to masquerade as other entities for authorization decisions relying on the X-Client-IP header, undermining security controls, and leaking sensitive client telemetry data."
}