7.3
High
CVE-2026-18875 IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated…
Description
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent server (api.vectordb.runbooks.js:51). An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer AI-driven MCP tool calls, potentially triggering unauthorized payment actions or exfiltrating payment data.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Financial Transaction Manager (FTM) for RedHat OpenShift 4.0 | 4.0.6.0 → 4.0.10.0 | No fix stated |
Other CVEs of Financial Transaction Manager (FTM) for RedHat OpenShift
The 46 CVEs of Financial Transaction Manager (FTM) for RedHat OpenShift →
CVE-2026-19267
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to missing authentication on the Business…
6.2
Medium
CVE-2026-19179
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipulate database…
8.2
High
CVE-2026-19087
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to achieve privilege…
4.4
Medium
CVE-2026-18872
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in…
9.3
Critical