IBM DataPower Gateway versions 11.0.0.0, 10.5.0.0 through 10.5.0.21, and 10.6.0.0 through 10.6.0.9 contain a race condition (CWE-362) related to improper synchronization of request state when processing the built-in X-Client-IP header. Under concurrent request conditions, the X-Client-IP header values may be improperly shared or contaminated between requests, leading to potential IP spoofing and unintended disclosure of client IP addresses. This vulnerability affects the isolation of request state in the gateway software. The CVSS 3.1 base score is 4.2, reflecting low confidentiality and integrity impacts with no availability impact. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

The vulnerability allows an attacker to cause contamination of the X-Client-IP header values across concurrent requests, which can lead to IP spoofing and disclosure of other clients' IP addresses. This compromises confidentiality and integrity of client IP information but does not affect availability. The impact is limited to information disclosure and spoofing within the affected IBM DataPower Gateway versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting concurrent request processing or applying configuration changes to reduce exposure if possible. Monitor IBM's security advisories for updates on patches or official mitigations.