An attacker can exploit a hard‑coded cryptographic key in IBM Financial Transaction Manager (FTM) for RedHat OpenShift to bypass authentication controls and retrieve protected data. The flaw permits remote exploitation without credentials, enabling direct access to transactions, audit logs, or configuration settings that are otherwise restricted. The vulnerability falls under CWE‑321, reflecting insecure key management.

IBM Financial Transaction Manager FTM for RedHat OpenShift versions up to and including 4.0.6.0 are affected. IBM recommends upgrading to release 4.0.11.0, which contains the remediation that removes the hard‑coded key and restores proper authentication mechanisms. All deployments running the vulnerable image or previously installed FTM components should be evaluated.

With a CVSS score of 8.1 the issue is classified as High severity, and although an EPSS score is not available, the lack of a KEV listing suggests no widespread public exploitation has been documented yet. The attack requires only network access to the FTM instance and can be carried out remotely, making it immediately actionable by threat actors. Consequently, environments should patch promptly to eliminate this attack vector.