01 Record

CVE-2026-109158

IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Insertion of Sensitive Information into Log File

HighPUBLISHEDCNA: ibm

CNA base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

View raw JSON

02 Description

IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Insertion of Sensitive Information into Log File

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: Not scored by EPSS
EPSS percentile: Not scored by EPSS
NVD base score: 7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD analysis status: Awaiting Analysis. NVD last modified this record on 2026-11-13.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-11-13 22:03Z2 HR AGO

Last updated

2026-11-13 22:03Z2 HR AGO

Reserved

2026-10-12

Assigning CNA

ibm

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-532Insertion of Sensitive Information into Log FileBase

Data version

5.2

Document digest

88bfabd4a3e6e5ed3b7b4d86edc8cf81e16f7c902e3d41c0c9e49882931c6991

05 Affected products

VendorProductVersionsPlatforms

IBMApp Connect Operator12.1.0 to 12.21.0, 12.0.0 to 12.0.28, 13.0.0 to 13.6.0—

IBMApp Connect Enterprise Certified Containers Operands12.0.11.1-r1 to 12.0.12.5-r1, 13.0.1.0-r1 to 13.0.6.2-r1, 12.0.12-r1 to 12.0.12-r28, 13.0.7.0-r1 to 13.0.9.0-r1—

06 References

www.ibm.comhttps://www.ibm.com/support/pages/node/7296008vendor-advisorypatch

07 Remediation

IBM strongly suggests the following: App Connect Enterprise Certified Container CD and 13 LTS (Long Term Support) Upgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher. Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator App Connect Enterprise Certified Container 12.0 LTS (Long Term Support) Upgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher. Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases