CVE-2026-18169: Critical IBM FTM for Red Hat OpenShift Flaws (CVSS 9.9) — Detection and Remediation Guide

---
title: Symlink Targeting Sensitive Kubernetes Service Account Paths in FTM Pods
id: 3f9a2c71-8b44-4d1e-9c7a-2e5f8a1b6d09
status: experimental
description: Detects read or openat syscalls against Kubernetes service account token and secret paths originating from IBM FTM container workloads on OpenShift, consistent with exploitation of CVE-2026-18169 symlink validation flaws.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18169
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|contains:
      - '/var/run/secrets/kubernetes.io/serviceaccount/token'
      - '/var/run/secrets/kubernetes.io/serviceaccount/ca.crt'
      - '/run/secrets/kubernetes.io/serviceaccount/'
  selection_process:
    Image|contains:
      - 'ftm'
      - 'java'
  condition: selection_paths and selection_process
falsepositives:
  - FTM components legitimately reading their own mounted service account token for Kubernetes API calls; baseline normal behavior per namespace before enabling alerting
level: high
---
title: Suspicious Symlink Creation in FTM Application Directories on OpenShift Nodes
id: 8c1d4e62-3a75-4f29-b8d1-7e2a5c9f4013
status: experimental
description: Detects creation of symbolic links within IBM FTM application, upload, or temp directories, a prerequisite behavior for exploiting improper symlink validation such as CVE-2026-18169.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18169
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_cmd:
    CommandLine|startswith:
      - 'ln -s'
      - '/bin/ln -s'
      - 'busybox ln -s'
  selection_target:
    CommandLine|contains:
      - '/opt/ibm/ftm'
      - '/ftm/uploads'
      - '/tmp/'
      - '/var/ftm'
  condition: selection_cmd and selection_target
falsepositives:
  - FTM installer, upgrade, or operator reconciliation jobs creating symlinks during deployment; correlate with change windows
level: medium
---
title: FTM Container Spawning Shell or Command Interpreter
id: 5b7e3a18-9c42-4d87-a1f6-4d8b2e7c0951
status: experimental
description: Detects shell interpreters spawned within IBM FTM containers on OpenShift nodes, a strong post-exploitation signal consistent with remote code execution vulnerabilities CVE-2026-18162 and CVE-2026-18163.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18169
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'java'
      - 'ftm'
      - 'node'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/ash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - IBM support scripts and operator health-check exec probes; restrict alerting to non-liveness/non-readiness invocations by correlating with Kubernetes audit exec events
level: high

// Hunt 1: Reads of Kubernetes service account secrets or sensitive paths from FTM pods
// Requires Syslog/Falco or OpenShift audit ingestion via CEF or Syslog connector
let ftmNamespaces = dynamic(["ftm", "ftm-prod", "financial-transaction-manager"]);
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in~ ("java", "node", "ftm") or SyslogMessage has_any ("ftm")
| where SyslogMessage has_any (
    "/var/run/secrets/kubernetes.io/serviceaccount/token",
    "/etc/shadow",
    "/etc/ssl/private",
    "id_rsa",
    ".kube/config"
)
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc;

// Hunt 2: OpenShift audit — exec sessions or suspicious API calls against FTM pods
// Requires OpenShift/Kubernetes audit log ingestion
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor =~ "Kubernetes" or AdditionalExtensions has "audit.openshift.io"
| where Message has_all ("exec", "ftm")
    or (Message has "pods/exec" and Message has_any ("ftm", "financial-transaction-manager"))
| extend User = coalesce(SourceUserID, SourceUserName)
| project TimeGenerated, User, SourceIP, Message, RequestURL
| order by TimeGenerated desc;

// Hunt 3: Outbound connections from FTM pods to rare external destinations (post-RCE exfil/C2)
// Requires network flow logs (e.g., OpenShift OVN-K flow logs, Cilium Hubble, or NSG-equivalent) in Sentinel
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceAction =~ "allowed" or DeviceAction =~ "accept"
| where SourceHostName has_any ("ftm") or SourceZone has_any ("ftm")
| where DestinationIP !startswith "10." and DestinationIP !startswith "172.16." and DestinationIP !startswith "192.168."
| summarize Connections = count(), Ports = make_set(DestinationPort) by SourceHostName, DestinationIP, DestinationHostName
| where Connections < 5  // rare destinations
| order by Connections asc;

-- Hunt for suspicious symlinks and FTM container process anomalies on OpenShift nodes
-- Deploy as a hunt scoped to nodes hosting FTM workloads

-- 1) Find symlinks inside FTM container filesystems pointing outside expected roots
SELECT FullPath,
       Data.target AS SymlinkTarget,
       Mtime,
       Size
FROM glob(globs='/var/lib/containers/storage/overlay/*/merged/**',
          accessor='file')
WHERE FullPath =~ '(ftm|financial-transaction-manager)'
  AND Data.target =~ '(/etc/|/var/run/secrets|/root|/proc|shadow|id_rsa|\.kube)'

UNION

-- 2) Identify shell/downloading processes spawned under FTM container workloads
SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE (Name =~ '(sh|bash|dash|curl|wget|python|nc|ncat)$'
       AND CommandLine =~ '(ftm|/opt/ibm)')
   OR (CommandLine =~ 'ln -s'
       AND CommandLine =~ '(ftm|/tmp|/var/ftm|/opt/ibm)')

UNION

-- 3) Network connections held by processes inside FTM containers
SELECT Pid,
       Name,
       Exe,
       CommandLine,
       Family,
       Type,
       Laddr.IP AS LocalIP,
       Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP,
       Raddr.Port AS RemotePort,
       Status
FROM netstat()
WHERE CommandLine =~ '(java|ftm|node)'
  AND RemoteIP !~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'
  AND RemoteIP != ''

#!/bin/bash
# Security Arsenal - IBM FTM on OpenShift Exposure Audit
# CVE-2026-18169 / CVE-2026-18162 / CVE-2026-18163 / CVE-2026-17635 / CVE-2026-17645
# Requires: oc CLI authenticated with cluster-admin, jq installed

set -euo pipefail

echo "=== [1/6] Identify FTM namespaces and deployments ==="
oc get namespaces -o name | grep -iE 'ftm|financial-transaction' || echo "No FTM namespaces found by name - verify manually"

FTM_NS=$(oc get namespaces -o json | jq -r '.items[].metadata.name' | grep -iE 'ftm|financial-transaction' | head -1)
if [ -z "${FTM_NS}" ]; then
  echo "ERROR: Could not auto-detect FTM namespace. Set FTM_NS manually and re-run."
  exit 1
fi
echo "Using namespace: ${FTM_NS}"

echo "=== [2/6] Inventory FTM images and versions (compare against IBM fixed versions) ==="
oc get pods -n "${FTM_NS}" -o json | \
  jq -r '.items[].spec.containers[] | "\(.name): \(.image)"' | sort -u
echo "ACTION REQUIRED: Compare each image tag above against the fixed versions in IBM's security bulletin for CVE-2026-18169 et al."

echo "=== [3/6] Check service account RBAC bound to FTM pods (privilege escalation risk post-compromise) ==="
SA_LIST=$(oc get pods -n "${FTM_NS}" -o json | jq -r '.items[].spec.serviceAccountName' | sort -u)
for sa in ${SA_LIST}; do
  echo "--- ServiceAccount: ${sa} ---"
  oc get rolebindings,clusterrolebindings -A -o json | \
    jq -r --arg sa "${sa}" --arg ns "${FTM_NS}" \
    '.items[] | select(.subjects[]? | select(.kind=="ServiceAccount" and .name==$sa)) | "\(.kind)/\(.metadata.name) -> \(.roleRef.name)"'
done
echo "ACTION REQUIRED: Remove any cluster-admin or wildcard (*) role bindings for FTM service accounts."

echo "=== [4/6] Audit persistent volumes for suspicious symlinks (CVE-2026-18169 artifact) ==="
for pod in $(oc get pods -n "${FTM_NS}" -o name); do
  echo "--- Checking ${pod} ---"
  oc exec -n "${FTM_NS}" "${pod#pod/}" -- sh -c \
    'find /opt/ibm /var/ftm /tmp -type l -ls 2>/dev/null | head -50' 2>/dev/null || echo "(exec restricted or no matching dirs - check manually)"
done
echo "ACTION REQUIRED: Any symlink resolving outside the application directory (especially to /etc, /var/run/secrets) is suspect."

echo "=== [5/6] Verify NetworkPolicies restrict ingress to FTM pods ==="
oc get networkpolicies -n "${FTM_NS}" -o wide
echo "ACTION REQUIRED: If no NetworkPolicies exist, FTM pods are reachable cluster-wide. Apply default-deny + allowlist immediately."

echo "=== [6/6] Check for SecurityContextConstraints allowing privileged or hostPath access ==="
oc get pods -n "${FTM_NS}" -o json | \
  jq -r '.items[] | "\(.metadata.name): privileged=\([.spec.containers[].securityContext.privileged] | unique) scc=\(.metadata.annotations["openshift.io/scc"])"'
echo "ACTION REQUIRED: FTM pods should run under 'restricted' SCC. Anything privileged or anyuid materially increases CVE blast radius."

echo "=== Audit complete. Escalate findings to your vulnerability management queue with a 72-hour SLA for the CVSS 9.x items. ==="