Live › vulnerability › CVE-2026-17491
Go to dashboardIBM i 7.3 through 7.6 does not properly enforce the ChrootDirectory configuration directive. A remote user who already has valid credentials can get around the directory confinement that the directive is meant to impose.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
IBM i systems that use the ChrootDirectory directive to confine remote authenticated users to a directory. Systems that do not configure ChrootDirectory, or that do not give remote users accounts, are unlikely to be exposed. The sources do not describe the exact configuration path beyond the directive name.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ibm i | vendor | = 7.3 | – |
| ibm i | vendor | = 7.4 | – |
| ibm i | vendor | = 7.5 | – |
| ibm i | vendor | = 7.6 | – |
WRKPTFGRP or GO LICPGM (unknown exact command in sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive.
This page as .md · .json · in your agent: get_signal("CVE-2026-17491")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.