What is GHSA-p6wq-xx5g-mm4g?

GHSA-p6wq-xx5g-mm4g is a security advisory published by GitHub Security Advisories with Medium severity. IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0...

Which CVE IDs does GHSA-p6wq-xx5g-mm4g cover?

GHSA-p6wq-xx5g-mm4g covers the following CVE IDs: CVE-2026-7366. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p6wq-xx5g-mm4g?

GHSA-p6wq-xx5g-mm4g has a CVSS v3 base score of 4.2, published by GitHub Security Advisories.

GHSA-p6wq-xx5g-mm4gMediumCVSS 4.2

IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0...

Vendor

GitHub Security Advisories

Published

August 13, 2026

Last Modified

August 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-7366 →

📋 Description

IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients’ IP addresses.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-7366
https://www.ibm.com/support/pages/node/7282770
https://github.com/advisories/GHSA-p6wq-xx5g-mm4g