IXP Manager IDOR Vulnerability in API Key Management (CVE-2026-63338)
Executive & SecOps Summary
SECOPS ASSESSMENTAll IXP Manager installations prior to version 7.3.0.
Authenticated attackers can view or modify API keys belonging to other users, potentially leading to full administrative takeover of the IXP infrastructure.
Immediately upgrade IXP Manager to version 7.3.0 or later.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUNDThe vulnerability is addressed in version 7.3.0. Administrators are urged to apply the update immediately.
1. Upgrade Instructions
# Navigate to your IXP Manager directory
cd /var/www/ixpmanager
# Fetch and checkout the secure version
git fetch
git checkout v7.3.0
# Update dependencies and database schema
composer install --no-dev
php artisan migrate2. Temporary Mitigation
If an immediate upgrade is not possible, implement WAF rules to inspect and restrict access to /api-key/edit and /api-key/update endpoints, looking for suspicious ID manipulation patterns from non-administrative accounts.
Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
A Broken Access Control vulnerability (specifically IDOR) exists in the ApiKeyController of IXP Manager. The application selects API key records for editing or updating based solely on the record identifier without verifying that the user_id matches the authenticated caller. This allows any authenticated user to manipulate the API keys of other users by guessing or enumerating ID values. Given the critical role of IXP Manager in internet infrastructure, this flaw poses a high risk to network integrity.
Official Vendor Advisories & References
IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyController` selects records by identifier without checking that `user_id` matches the caller, allowing access to another user's API-key record. This issue is fixed in version 7.3.0.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.