Host Header Injection in IBM Common Licensing Agent and ART

IBM Common Licensing Agent and IBM Common Licensing ART versions 9.0, 9.0.0.1, and 9.0.0.2 contain a critical vulnerability, tracked as CVE-2026-19646, resulting from the improper validation of the HTTP Host header. This flaw allows a remote, unauthenticated attacker to manipulate the Host header in incoming HTTP requests to force the application to redirect users to an arbitrary, attacker-controlled domain. This vulnerability facilitates phishing campaigns, credential harvesting, and the delivery of malicious content by abusing the trust associated with the targeted licensing infrastructure. With a CVSS base score of 9.1, this vulnerability poses a significant risk to organizations relying on these products for license management.

Impact

Successful exploitation allows attackers to perform open redirects through the licensing application. This can be weaponized to bypass security controls, trick users into visiting malicious websites, or conduct targeted social engineering attacks, potentially leading to widespread internal credential theft or compromise of administrative sessions within the corporate environment.

Recommendation

Prioritize the remediation of all affected IBM Common Licensing Agent and ART instances. Monitor web server logs for suspicious requests containing modified Host headers that deviate from expected internal hostnames.

• Upgrade all instances of IBM Common Licensing Agent and ART to the latest patched version provided by IBM.
• Implement strict HTTP Host header validation on load balancers or reverse proxies sitting in front of these services to reject requests with unexpected Host values.
• Audit webserver access logs for anomalous redirects occurring from the licensing application paths to external domains.