CVE-2026-7366

IBM DataPower Gateway is affected by a race condition in the XML-Firewall’s handling of the built-in X‑Client‑IP header, causing improper isolation of request state across concurrent requests. This can enable IP spoofing and disclosure of other clients’ IP addresses. Affected versions include 11....