{"slug": "unauthenticated-rag-poisoning-in-ibm-financial-transaction-manager-exposes-mcp", "title": "Unauthenticated RAG Poisoning in IBM Financial Transaction Manager Exposes MCP Tool Calls to Hijacking", "summary": "IBM released Security Bulletin node/7288641 on September 23, 2026, addressing 47 vulnerabilities in IBM Financial Transaction Manager (FTM) for RedHat OpenShift, including CVE-2026-18875, a RAG poisoning flaw with a CVSS score of 7.3 that lets an unauthenticated attacker inject content into the AI agent's vector database at api.vectordb.runbooks.js:51 and steer Model Context Protocol tool calls toward unauthorized payment actions or financial data exfiltration. The same bulletin includes CVE-2026-18162, a code injection flaw scored 9.8, and IBM requires operators on FTM versions 4.0.6.0 through 4.0.10.0, including the iFix6 Refresh, to upgrade to version 4.0.11.0. The flaw maps to OWASP Top 10 for LLM Applications 2026 entry LLM09:2026 on Vector and Embedding Weaknesses.", "body_md": "On September 23, 2026, IBM released [Security Bulletin node/7288641](https://www.ibm.com/support/pages/node/7288641), which addresses a total of 47 vulnerabilities identified within the IBM Financial Transaction Manager (FTM) for RedHat OpenShift platform. Among these disclosures, CVE-2026-18875 stands out as a significant security concern, carrying a CVSS score of 7.3. This vulnerability highlights the increasing complexity of securing AI-integrated financial infrastructure, specifically regarding the integrity of Retrieval-Augmented Generation (RAG) pipelines used in automated transaction processing.\n\nThe technical root of CVE-2026-18875 is located within the FTM AI agent server, specifically at api.vectordb.runbooks.js:51. The vulnerability manifests as a RAG poisoning flaw that allows an unauthenticated attacker to execute a network-based runbook upsert. By leveraging this entry point, an attacker can inject arbitrary, malicious content directly into the agent’s vector database. Because the system relies on this database to provide context for decision-making, the injection effectively compromises the knowledge base upon which the AI agent operates.\n\nThe severity of this flaw is amplified by the interaction between the poisoned vector database and the [Model Context Protocol](https://forkast.news/glossary/model-context-protocol/) (MCP) layer. When the AI agent retrieves information from the compromised database, the injected content is processed as legitimate context. This poisoned context is then used to steer MCP tool calls. Because the agent is authorized to perform sensitive operations, the manipulated tool calls can force the system to execute unauthorized payment actions or facilitate the exfiltration of sensitive financial data, bypassing intended operational safeguards.\n\nThis vulnerability aligns with the risks identified in the [OWASP Top 10 for LLM Applications 2026](https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/), specifically LLM09:2026, which covers Vector and Embedding Weaknesses. The OWASP framework emphasizes that corpus and data poisoning represent critical attack vectors in modern AI architectures. In this instance, the FTM implementation demonstrates how minimal document injection into a vector store can be sufficient to hijack agent operations, effectively turning the agent’s own retrieval mechanism against the integrity of the financial transaction environment.\n\nThe scope of the security breakdown within the FTM package is further underscored by the presence of other severe flaws in the same bulletin. Most notably, CVE-2026-18162, which carries a critical CVSS score of 9.8, involves a code injection vulnerability stemming from the use of the new Function constructor. The concurrent discovery of these vulnerabilities suggests a broader systemic challenge in maintaining secure boundaries within the FTM architecture, necessitating a comprehensive review of both AI-specific and traditional code execution paths.\n\nRemediation for these vulnerabilities is mandatory for all affected deployments. The vulnerability impacts FTM versions 4.0.6.0 through 4.0.10.0, including the iFix6 Refresh. To mitigate the risks posed by CVE-2026-18875 and the associated critical vulnerabilities, operators must upgrade their FTM for RedHat OpenShift environments to version 4.0.11.0. Given the potential for unauthorized financial transactions and data exfiltration, immediate patching is required to restore the integrity of the AI agent’s operational context and the overall security posture of the transaction management system.", "url": "https://wpnews.pro/news/unauthenticated-rag-poisoning-in-ibm-financial-transaction-manager-exposes-mcp", "canonical_source": "https://forkast.news/unauthenticated-rag-poisoning-in-ibm-financial-transaction-manager-exposes-mcp-tool-calls-to-hijacking/", "published_at": "2026-09-25 01:47:18+00:00", "updated_at": "2026-09-25 01:59:18.732518+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-policy", "large-language-models", "ai-infrastructure"], "entities": ["IBM", "IBM Financial Transaction Manager for RedHat OpenShift", "CVE-2026-18875", "CVE-2026-18162", "Model Context Protocol", "OWASP Top 10 for LLM Applications 2026", "Red Hat OpenShift", "Security Bulletin node/7288641"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/unauthenticated-rag-poisoning-in-ibm-financial-transaction-manager-exposes-mcp", "markdown": "https://wpnews.pro/news/unauthenticated-rag-poisoning-in-ibm-financial-transaction-manager-exposes-mcp.md", "text": "https://wpnews.pro/news/unauthenticated-rag-poisoning-in-ibm-financial-transaction-manager-exposes-mcp.txt", "jsonld": "https://wpnews.pro/news/unauthenticated-rag-poisoning-in-ibm-financial-transaction-manager-exposes-mcp.jsonld"}}