SB2026100508 - Multiple vulnerabilities in IBM webMethods API Gateway
Published: October 5, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Interpretation Conflict (CVE-ID: CVE-2026-16221)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host-based policy checks and route requests to an unintended destination.
The vulnerability exists due to interpretation conflict in the fast-uri URL parser when parsing URLs containing a literal backslash in the authority section for special schemes. A remote attacker can supply a specially crafted URL to bypass host-based policy checks and route requests to an unintended destination.
This issue can occur when an application validates a URL with fast-uri and then passes the same input to Node's WHATWG URL parser or fetch-related consumers, which extract a different host from the same string.
2) Interpretation Conflict (CVE-ID: CVE-2026-18446)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host-based policy checks and steer requests to an unintended destination.
The vulnerability exists due to interpretation conflict in the fast-uri URI parser when parsing references that use backslash-based authority introducers. A remote attacker can supply a specially crafted URL to bypass host-based policy checks and steer requests to an unintended destination.
The issue arises from inconsistent host extraction between fast-uri and Node's WHATWG URL handling for special schemes.
3) Double Decoding of the Same Data (CVE-ID: CVE-2026-75899)
CWE-ID: CWE-174 - Double Decoding of the Same Data
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to double decoding of the same data in the fast-uri normalize() and resolve() hostname handling logic when processing a URI with a nested percent-encoded host. A remote attacker can supply a specially crafted URI to perform server-side request forgery.
The issue can cause the hostname to be interpreted as a different destination than the input appears to contain, including internal addresses such as loopback or a cloud metadata endpoint.
4) Interpretation Conflict (CVE-ID: CVE-2026-6322)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host-based security checks and route requests to an unintended authority.
The vulnerability exists due to interpretation conflict in the URI host component when processing percent-encoded authority delimiters. A remote attacker can supply a specially crafted URL to bypass host-based security checks and route requests to an unintended authority.
This issue can affect applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing.
5) Interpretation Conflict (CVE-ID: CVE-2026-75931)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host-based policy checks.
The vulnerability exists due to interpretation conflict in the resolve() host canonicalization logic when resolving scheme-relative references against a scheme-bearing base. A remote attacker can supply a specially crafted scheme-relative reference to bypass host-based policy checks.
Re-parsing the resolved URI can yield a different host than the one returned by resolve().
6) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-75975)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host-policy checks and perform server-side request forgery.
The vulnerability exists due to improper input validation in the IPv6 literal normalization logic of fast-uri when normalizing untrusted URLs containing malformed bracketed IPv6 literals. A remote attacker can supply a specially crafted URL to bypass host-policy checks and perform server-side request forgery.
Malformed bracketed IPv6 literals with invalid trailing text are silently truncated to different valid IPv6 addresses, and parse().error is not set for these inputs.
7) Improper Handling of URL Encoding (Hex Encoding) (CVE-ID: CVE-2026-76172)
CWE-ID: CWE-177 - Improper Handling of URL Encoding (Hex Encoding)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host validation and inject carriage return and line feed characters into output.
The vulnerability exists due to improper handling of url encoding in the scheme component normalization logic when normalizing or resolving untrusted URLs. A remote attacker can supply a specially crafted percent-encoded scheme to bypass host validation and inject carriage return and line feed characters into output.
Applications that treat a missing authority as same-origin during redirect checks, host allowlist enforcement, or outbound request decisions are particularly exposed.
Remediation
Install update from vendor's website.