UNAUTHENTICATED RAG POISONING IN IBM FINANCIAL TRANSACTION MANAGER EXPOSES MCP TOOL CALLS TO HIJACKING

**Hacker Pranks Exclusive: IBM Financial Transaction Manager Exposes Financial Data to Unauthenticated RAG Poisoning**

In a recent security bulletin, IBM revealed a total of 47 vulnerabilities in the IBM Financial Transaction Manager (FTM) for RedHat OpenShift platform. Among these, CVE-2026-18875 stands out as a significant security concern, carrying a CVSS score of 7.3. This vulnerability highlights the increasing complexity of securing AI-integrated financial infrastructure, specifically regarding the integrity of Retrieval-Augmented Generation (RAG) pipelines used in automated transaction processing.

**The Technical Root of the Vulnerability**

The technical root of CVE-2026-18875 is located within the FTM AI agent server, specifically at `api.vectordb.runbooks.js:51`. The vulnerability manifests as a RAG poisoning flaw that allows an unauthenticated attacker to execute a network-based runbook upsert. By leveraging this entry point, an attacker can inject arbitrary, malicious content directly into the agent's vector database. This compromised knowledge base is then used to provide context for decision-making, allowing the attacker to manipulate the AI agent's actions.

**The Severity of the Flaw**

The severity of this flaw is amplified by the interaction between the poisoned vector database and the Model Context Protocol (MCP) layer. When the AI agent retrieves information from the compromised database, the injected content is processed as legitimate context. This poisoned context is then used to steer MCP tool calls, allowing the attacker to force the system to execute unauthorized payment actions or facilitate the exfiltration of sensitive financial data.

**Aligning with OWASP Guidelines**

This vulnerability aligns with the risks identified in the OWASP Top 10 for LLM Applications 2026, specifically LLM09:2026, which covers Vector and Embedding Weaknesses. The OWASP framework emphasizes that corpus and data poisoning represent critical attack vectors in modern AI architectures. In this instance, the FTM implementation demonstrates how minimal document injection into a vector store can be sufficient to hijack agent operations, effectively turning the agent's own retrieval mechanism against the integrity of the financial transaction environment.

**Broader Systemic Challenges**

The scope of the security breakdown within the FTM package is further underscored by the presence of other severe flaws in the same bulletin. Most notably, CVE-2026-18162, which carries a critical CVSS score of 9.8, involves a code injection vulnerability stemming from the use of the new Function constructor. The concurrent discovery of these vulnerabilities suggests a broader systemic challenge in maintaining secure boundaries within the FTM architecture, necessitating a comprehensive review of both AI-specific and traditional code execution paths.

**Remediation Required**

Remediation for these vulnerabilities is mandatory for all affected deployments. The vulnerability impacts FTM versions 4.0.6.0 through 4.0.10.0, including the iFix6 Refresh. To mitigate the risks posed by CVE-2026-18875 and the associated critical vulnerabilities, operators must upgrade their FTM for RedHat OpenShift environments to version 4.0.11.0. Given the potential for unauthorized financial transactions and data exfiltration, immediate patching is required to restore the integrity of the AI agent's operational context and the overall security posture of the transaction management system.

In conclusion, the IBM Financial Transaction Manager vulnerability highlights the importance of securing AI-integrated financial infrastructure against RAG poisoning attacks. As AI adoption continues to grow, so does the risk of these types of attacks. It is essential for organizations to stay vigilant and prioritize the security of their financial infrastructure to prevent unauthorized transactions and data exfiltration.