CVE-2026-17617

Successful exploitation allows an attacker to induce IBM Application Gateway Operator to send requests to attacker-chosen or otherwise unintended endpoints from the operator's execution context. This can expose internal network-reachable services or sensitive resources that are not directly accessible to the attacker. The published CVSS vector indicates high confidentiality impact, limited integrity impact, no direct availability impact, and a changed scope, consistent with access to data or services reachable through the operator rather than direct compromise of the vulnerable component itself.

Restrict who can create or modify IBM Application Gateway Operator custom resources, since exploitation requires control over URL values in those resources. Limit the operator's outbound network access using Kubernetes network policies, egress controls, firewalls, or equivalent segmentation so it cannot reach sensitive internal services or metadata endpoints unnecessarily. Monitor and review custom resource definitions and operator activity for unexpected outbound request behavior until a fixed version is deployed.

Upgrade IBM Application Gateway Operator to a fixed release newer than version 26.06. Apply the vendor-provided update that corrects validation of URLs supplied in custom resources so that operator-initiated requests cannot be redirected to unintended destinations.