{"id":"CVE-2026-17491","kind":"vulnerability","aliases":["CVE-2026-17491"],"related":[],"title":"IBM i: authenticated users can bypass ChrootDirectory restrictions remotely","description":"IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive.","summary":"IBM i 7.3 through 7.6 does not properly enforce the ChrootDirectory configuration directive. A remote user who already has valid credentials can get around the directory confinement that the directive is meant to impose.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm i","fixed":[],"affected":"= 7.3","ecosystem":"vendor"},{"name":"ibm i","fixed":[],"affected":"= 7.4","ecosystem":"vendor"},{"name":"ibm i","fixed":[],"affected":"= 7.5","ecosystem":"vendor"},{"name":"ibm i","fixed":[],"affected":"= 7.6","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-i","infrastructure","on-prem","sftp","ssh"],"not_affected_if":["no-chrootdirectory-config","no-remote-accounts"],"how_to_check":"- Confirm the IBM i release with `WRKPTFGRP` or `GO LICPGM` (unknown exact command in sources)\n- Check whether ChrootDirectory is configured for SSH or SFTP users (unknown exact file or setting in sources)","fix":"- Apply the IBM fix for IBM i 7.3, 7.4, 7.5 and 7.6 (fixed versions unknown in sources; check the IBM security bulletin)","status":"open","published_at":"2026-10-16T19:17:06+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:18:14+00:00","updated_at":"2026-10-25T04:18:14+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:18:14Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the IBM fix for IBM i 7.3, 7.4, 7.5 and 7.6 (fixed versions unknown in sources; check the IBM security bulletin)","reach":"network","title":"IBM i: authenticated users can bypass ChrootDirectory restrictions remotely","impact":"medium","summary":"IBM i 7.3 through 7.6 does not properly enforce the ChrootDirectory configuration directive. A remote user who already has valid credentials can get around the directory confinement that the directive is meant to impose.","category":"infrastructure","nicknames":[],"who_cares":["ibm-i","ssh","sftp","on-prem"],"confidence":0.5,"needs_auth":"yes","worst_case":"Authenticated remote user escapes chroot confinement and reaches restricted files","analyst_note":"Find the IBM security bulletin for CVE-2026-17491 to get fixed versions, PTF numbers and the exact configuration that is affected.","how_to_check":"- Confirm the IBM i release with `WRKPTFGRP` or `GO LICPGM` (unknown exact command in sources)\n- Check whether ChrootDirectory is configured for SSH or SFTP users (unknown exact file or setting in sources)","needs_analyst":true,"not_affected_if":["no-chrootdirectory-config","no-remote-accounts"],"who_is_affected":"IBM i systems that use the ChrootDirectory directive to confine remote authenticated users to a directory. Systems that do not configure ChrootDirectory, or that do not give remote users accounts, are unlikely to be exposed. The sources do not describe the exact configuration path beyond the directive name.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000646,"input_tokens":3389,"output_tokens":614,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17491':12A,15A '-2026':11A,14A '7.3':35B,69C '7.4':70C '7.5':71C '7.6':37B,73C 'allow':76C 'alreadi':50B 'around':56B 'attack':80C 'authent':3A,79C 'bypass':6A,82C 'chrootdirectori':7A,43B,91C 'configur':44B,92C 'confin':59B 'could':75C 'credenti':53B 'cve':10A,13A 'direct':45B,62B,93C 'directori':58B 'due':85C 'enforc':41B,88C 'get':55B 'i':17A,19A,21A,23A 'ibm':1A,16A,18A,20A,22A,25B,33B,67C 'ibm-i':24B 'impos':66B 'improp':87C 'infrastructur':27B 'meant':64B 'on-prem':28B 'prem':30B 'proper':40B 'remot':9A,47B,78C 'restrict':8A,84C 'secur':83C 'sftp':31B 'ssh':32B 'user':4A,48B 'valid':52B","nicknames":[],"mitigations":[],"who_affected":"IBM i systems that use the ChrootDirectory directive to confine remote authenticated users to a directory. Systems that do not configure ChrootDirectory, or that do not give remote users accounts, are unlikely to be exposed. The sources do not describe the exact configuration path beyond the directive name.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T19:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17491","severity":null,"published_at":"2026-10-16T19:17:06+00:00","modified_at":"2026-10-23T15:40:47+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}