CVE-2026-18875
EUVD-2026-8535523.09.2026, 16:16
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent server (api.vectordb.runbooks.js:51). An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer AI-driven MCP tool calls, potentially triggering unauthorized payment actions or exfiltrating payment data.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| ibm | financial_transaction_manager | 4.0.7.0 ≤ 𝑥 < 4.0.11.0 |
| ibm | financial_transaction_manager | 4.0.6.0 |
| ibm | financial_transaction_manager | 4.0.6.0:interim_fix_1 |
| ibm | financial_transaction_manager | 4.0.6.0:interim_fix_2 |
| ibm | financial_transaction_manager | 4.0.6.0:interim_fix_3 |
| ibm | financial_transaction_manager | 4.0.6.0:interim_fix_4 |
| ibm | financial_transaction_manager | 4.0.6.0:interim_fix_5 |
| ibm | financial_transaction_manager | 4.0.6.0:interim_fix_6 |
𝑥
= Vulnerable software versions