CVE-2026-17643 is a High severity flaw in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift. Credentials are insufficiently protected, so a local attacker could obtain sensitive information and perform unauthorized actions. It scores 8.8. IBM's fix is FTM 4.0.11.0 and it lists no workaround.
What's affected
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, per IBM's bulletin 7288641 (published 21 September 2026):
- 4.0.6.0 through 4.0.6.0 iFix6
- 4.0.6.0 iFix6 Refresh (Operator 4.4.6+20260807.081800)
- 4.0.7.0
- 4.0.8.0
- 4.0.9.0
- 4.0.10.0
IBM's fix is FTM 4.0.11.0, and it lists no workarounds or mitigations. The bulletin is large: it lists more than 45 CVEs for FTM, and 4.0.11.0 is the remediation for all of them. This CVE is one of several credential handling issues in it.
The record scores it 8.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The vector is local, low complexity, low privileges, with changed scope and high impact on all three properties. IBM's bulletin gives the same 8.8.
How to check if you're exposed
Find the FTM version you have deployed. On OpenShift the operator is installed through Operator Lifecycle Manager, so list the installed operator versions and read the FTM entry.
oc get csv -A
oc get pods -A | grep -i ftm
The first command lists installed operator versions in every namespace. The second shows FTM pods, so you can confirm which namespaces hold FTM. If your deployment is below 4.0.11.0 it is in scope. Then list who has shell, exec or volume access to the FTM pods, since the attacker in this vector is local with low privileges.
What to do now
- Find every FTM deployment and its version.
- Upgrade to FTM 4.0.11.0.
- Restrict who can exec into FTM pods or read their volumes and mounted secrets, using OpenShift role bindings.
- After upgrading, ask IBM whether credentials used by earlier versions should be rotated. The bulletin does not say, so confirm with support.
- Read IBM's bulletin for the other CVEs that 4.0.11.0 fixes, and plan one upgrade, not many.
Why it matters
The record classes the weakness as CWE-522, Insufficiently Protected Credentials. Insufficiently protected credentials means secrets are kept where, or how, a user with limited access can reach them. The record classes this as CWE-522. IBM's description is short: a local attacker could obtain sensitive information and perform unauthorized actions.
The word local matters in a container platform. It does not mean someone at the keyboard. It can mean any process or user who obtains a foothold inside the cluster, or anyone allowed to run commands in the FTM pods. The changed scope in the vector says the effect reaches past the FTM component, which fits credentials that open other systems.
This bulletin has several credential related entries: a hard-coded credentials issue, hard-coded keys, and cleartext transmission. Taken together they suggest an area that was reviewed closely and fixed in one release. Plan one upgrade, and use the moment to review cluster access to FTM namespaces. No exploitation is reported and CISA does not list the CVE.
Try it yourself
A single product bulletin can carry dozens of CVEs. This demo shows how a vulnerability management view groups them, so one upgrade can close many findings at once.
Click through it at your own pace, or open it full screen.
Quick check
What does local mean on OpenShift?
Someone who can run code or commands inside the environment, for example in a pod or on a node. It does not require physical access.
Is the fix a configuration change?
IBM's remediation is upgrading to FTM 4.0.11.0.
Sources
- IBM Security Bulletin 7288641: IBM Financial Transaction Manager, fetched 18 October 2026
Last reviewed: 18 October 2026.
