IBM Financial Transaction Manager (FTM) for RedHat OpenShift version 4.0.6.0 contains a server-side request forgery (SSRF) vulnerability (CWE-918) that could be exploited by a local attacker with high privileges to access sensitive information and perform unauthorized actions. The CVSS 3.1 base score is 7.9, reflecting high impact on confidentiality and integrity but no impact on availability. The vulnerability is published and assigned CVE-2026-18066. No vendor advisory or patch information is currently available.

An attacker with local high privileges could exploit this SSRF vulnerability to gain access to sensitive information and execute unauthorized actions within the IBM Financial Transaction Manager environment. This could compromise confidentiality and integrity of the system. There is no indication of availability impact or active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity related to internal requests. Do not assume the vulnerability is mitigated without vendor confirmation.