Pre-auth authentication-filter bypass leading to RCE and QSECOFR (IBM Db2 Mirror for i)
A credible research firm published a working pre-auth RCE chain on 2026-09-14 with no vendor fix identified, leaving exposed administrative interfaces at immediate risk.
Silent Signal describes a bug chain in the IBM Db2 Mirror for i web GUI: a semicolon path-parameter trick (e.g. /Db2MirrorServlet;x/...) makes AuthFilter skip its session, BuildTimeStamp and MN checks while the container still routes the request, and an unauthenticated skipVald switch disables input validation. Chained, these reach arbitrary action methods, Java/JSP execution in Liberty, and escalation to QSECOFR on the local IBM i. No CVE, no IBM advisory, and no affected-version range are yet published.
Affected: not stated — the report concerns the IBM Db2 Mirror for i GUI WAR on the IBM i Liberty instance, tested on IBM i V7R5 with a late-2025 GUI build
How to Test
Check whether the Db2 Mirror for i GUI (Db2Mirror.war on the administrative Liberty instance) is deployed and network-reachable; test whether GET /Db2MirrorServlet;x/DbmConfigAction?function=getAppInitData returns application init JSON instead of 401/403, which indicates the filter bypass.
How to Mitigate
There is no confirmed fix; restrict the Db2 Mirror web interface to trusted management networks, block external access, and apply IBM updates once an advisory/patch is released.